Skip to content
Fencer Intel
medium 5.3

CVE-2018-1199 json

Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core

published 8y ago modified 4mo ago also GHSA-v596-fwhq-8x48 , EUVD-2018-0691

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

Patch / fix

  • maven org.springframework.security:spring-security-core 4.1.5, 4.2.4, 5.0.1
  • maven org.springframework:spring-core 4.3.14, 5.0.3
  • vmware spring_framework 4.3.14, 5.0.3
  • vmware spring_security 4.1.5, 4.2.4, 5.0.1
  • libspring-java Debian 14, Debian 13, Debian 12 4.3.14-1

debian advisories DEBIAN-CVE-2018-1199

Is CVE-2018-1199 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1199 updated cvss 7.5

spring-framework: Improper URL path validation allows for bypassing of security checks on static resources

  • Red Hat Fuse 7 spring Red Hat JBoss Fuse Integration Service 2 spring
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 9 (Mitaka) opendaylight Red Hat OpenStack Platform 10 (Newton) opendaylight Red Hat OpenStack Platform 11 (Ocata) opendaylight Red Hat OpenStack Platform 12 (Pike) opendaylight
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R7
    fixed: vendor fix RHSA-2018:2405
  • Red Hat Enterprise Linux 8 springframework, springframework-tx, springframework-aop, springframework-jms, springframework-orm, springframework-oxm, +14 more Red Hat JBoss A-MQ 6 spring Red Hat JBoss BRMS 5 spring Red Hat JBoss Data Virtualization 6 spring Red Hat JBoss Enterprise Application Platform 5 jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 6 jbossweb jbossweb
    +10 more products
    Red Hat JBoss Enterprise Application Platform 7 undertow-core Red Hat JBoss Enterprise Web Server 2 tomcat Red Hat JBoss Fuse 6 spring Red Hat JBoss Fuse Service Works 6 spring Red Hat JBoss Portal 6 spring Red Hat JBoss SOA Platform 5 spring Red Hat JBoss Web Server 3 tomcat Red Hat Mobile Application Platform 4 spring Red Hat OpenShift Enterprise 3 millicore Red Hat Storage 3 rhevm-dependencies
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.80% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.0 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.springframework.security:spring-security-core
>=4.2.0, <4.2.4
>=5.0.0, <5.0.1
>=4.1.0, <4.1.5
4.2.4
5.0.1
4.1.5
maven org.springframework:spring-core
>=4.3.0, <4.3.14
>=5.0.0, <5.0.3
4.3.14
5.0.3

Affected products

  • Dell EMC Spring by Pivotal

Classification

Weakness
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.