Skip to content
Fencer Vulns
high 8.8

CVE-2018-1258 json

Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass

published 2018-05-11 8 y ago modified 2026-08-25 2 mo ago also EUVD-2018-0586 , GHSA-cxrj-66c5-9fmh

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.5%
EPSS 2.5% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

Patch / fix

  • maven org.springframework:spring-core 5.0.6.RELEASE
  • org.springframework spring-core 5.0.6
  • pivotal_software spring_framework 5.0.6
  • vmware spring_framework 5.0.6
  • oracle communications_converged_application_server 7.0.0.1
  • oracle communications_diameter_signaling_router 8.3
  • oracle communications_performance_intelligence_center 10.2.1
  • oracle communications_services_gatekeeper 6.1.0.4.0
  • redhat fuse 7.4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1258 updated cvss 5.6

spring-security-core: Unauthorized Access with Spring Security Method Security

  • Red Hat Fuse 7.4.0
    fixed: vendor fix RHSA-2019:2413
  • Red Hat Enterprise Virtualization 3 jasperreports-server-pro Red Hat JBoss Fuse 6 spring-security-core Red Hat JBoss Fuse Integration Service 2 spring-security-core
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.46% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
GitHub 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
maven org.springframework:spring-core
>=5.0.5.RELEASE, <5.0.6.RELEASE
5.0.6.RELEASE

Affected products

  • Pivotal Spring Framework

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Removed sprint_security.