{"id":"CVE-2018-1258","details":"Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.","aliases":["GHSA-cxrj-66c5-9fmh"],"modified":"2026-08-27T11:47:36.781712537Z","published":"2018-05-11T20:29:00.260Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"7.3"},{"introduced":"9.4"}],"source":"CPE_RANGE","vendor_product":"netapp:oncommand_unified_manager","cpes":["cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vsphere:*:*","cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:*"]},{"source":"CPE_RANGE","vendor_product":"oracle:communications_diameter_signaling_router","cpes":["cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"8.3"}]},{"source":"CPE_RANGE","vendor_product":"oracle:communications_network_integrity","cpes":["cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.3.2"},{"last_affected":"7.3.6"}]},{"source":"CPE_RANGE","vendor_product":"oracle:communications_performance_intelligence_center","cpes":["cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"10.2.1"}]},{"vendor_product":"oracle:communications_services_gatekeeper","cpes":["cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"6.1.0.4.0"}],"source":"CPE_RANGE"},{"cpes":["cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"8.0.2.8191"}],"source":"CPE_RANGE","vendor_product":"oracle:mysql_enterprise_monitor"},{"vendor_product":"oracle:agile_product_lifecycle_management","cpes":["cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.4:*:*:*:*:*:*:*","cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*","cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.3.3"},{"last_affected":"9.3.3"},{"introduced":"9.3.4"},{"last_affected":"9.3.4"},{"introduced":"9.3.5"},{"last_affected":"9.3.5"},{"introduced":"9.3.6"},{"last_affected":"9.3.6"}],"source":"CPE_STRING"},{"source":"CPE_STRING","vendor_product":"oracle:application_testing_suite","cpes":["cpe:2.3:a:oracle:application_testing_suite:10.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"10.1"},{"last_affected":"10.1"},{"introduced":"12.5.0.3"},{"last_affected":"12.5.0.3"},{"introduced":"13.1.0.1"},{"last_affected":"13.1.0.1"},{"introduced":"13.2.0.1"},{"last_affected":"13.2.0.1"},{"introduced":"13.3.0.1"},{"last_affected":"13.3.0.1"}]},{"vendor_product":"oracle:big_data_discovery","cpes":["cpe:2.3:a:oracle:big_data_discovery:1.6.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.6.0"},{"last_affected":"1.6.0"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"13.2"},{"last_affected":"13.2"}],"source":"CPE_STRING","vendor_product":"oracle:enterprise_manager_for_mysql_database","cpes":["cpe:2.3:a:oracle:enterprise_manager_for_mysql_database:13.2:*:*:*:*:*:*:*"]},{"vendor_product":"oracle:enterprise_manager_ops_center","cpes":["cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.2.2"},{"last_affected":"12.2.2"},{"introduced":"12.3.3"},{"last_affected":"12.3.3"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"11.1.1.7.0"},{"last_affected":"11.1.1.7.0"},{"introduced":"12.1.3.0.0"},{"last_affected":"12.1.3.0.0"}],"source":"CPE_STRING","vendor_product":"oracle:enterprise_repository","cpes":["cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:*"]},{"extracted_events":[{"introduced":"12.2.0.1"},{"last_affected":"12.2.0.1"},{"introduced":"12.3.1.1"},{"last_affected":"12.3.1.1"},{"introduced":"12.3.2.1"},{"last_affected":"12.3.2.1"}],"source":"CPE_STRING","vendor_product":"oracle:goldengate_for_big_data","cpes":["cpe:2.3:a:oracle:goldengate_for_big_data:12.2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:goldengate_for_big_data:12.3.1.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:goldengate_for_big_data:12.3.2.1:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"oracle:insurance_calculation_engine","cpes":["cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_calculation_engine:10.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"10.1.1"},{"last_affected":"10.1.1"},{"introduced":"10.2"},{"last_affected":"10.2"},{"introduced":"10.2.1"},{"last_affected":"10.2.1"}]},{"extracted_events":[{"introduced":"10.0"},{"last_affected":"10.0"},{"introduced":"10.1"},{"last_affected":"10.1"},{"introduced":"10.2"},{"last_affected":"10.2"},{"introduced":"11.0"},{"last_affected":"11.0"}],"source":"CPE_STRING","vendor_product":"oracle:insurance_policy_administration","cpes":["cpe:2.3:a:oracle:insurance_policy_administration:10.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_policy_administration:10.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_policy_administration:10.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_policy_administration:11.0:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_rules_palette:10.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_rules_palette:11.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_rules_palette:11.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"10.0"},{"last_affected":"10.0"},{"introduced":"10.1"},{"last_affected":"10.1"},{"introduced":"10.2"},{"last_affected":"10.2"},{"introduced":"11.0"},{"last_affected":"11.0"},{"introduced":"11.1"},{"last_affected":"11.1"}],"source":"CPE_STRING","vendor_product":"oracle:insurance_rules_palette"},{"source":"CPE_STRING","vendor_product":"oracle:micros_lucas","cpes":["cpe:2.3:a:oracle:micros_lucas:2.9.5:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.9.5"},{"last_affected":"2.9.5"}]},{"cpes":["cpe:2.3:a:oracle:peoplesoft_enterprise_fin_install:9.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.2"},{"last_affected":"9.2"}],"source":"CPE_STRING","vendor_product":"oracle:peoplesoft_enterprise_fin_install"},{"vendor_product":"oracle:retail_assortment_planning","cpes":["cpe:2.3:a:oracle:retail_assortment_planning:14.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_assortment_planning:15.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_assortment_planning:16.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.1"},{"last_affected":"14.1"},{"introduced":"15.0"},{"last_affected":"15.0"},{"introduced":"16.0"},{"last_affected":"16.0"}],"source":"CPE_STRING"},{"vendor_product":"oracle:retail_back_office","cpes":["cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.0"},{"last_affected":"14.0"},{"introduced":"14.1"},{"last_affected":"14.1"}],"source":"CPE_STRING"},{"source":"CPE_STRING","vendor_product":"oracle:retail_central_office","cpes":["cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.0"},{"last_affected":"14.0"},{"introduced":"14.1"},{"last_affected":"14.1"}]},{"extracted_events":[{"introduced":"15.0"},{"last_affected":"15.0"},{"introduced":"16.0"},{"last_affected":"16.0"}],"source":"CPE_STRING","vendor_product":"oracle:retail_customer_insights","cpes":["cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:retail_financial_integration:13.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_financial_integration:14.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_financial_integration:14.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_financial_integration:15.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_financial_integration:16.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.2"},{"last_affected":"13.2"},{"introduced":"14.0"},{"last_affected":"14.0"},{"introduced":"14.1"},{"last_affected":"14.1"},{"introduced":"15.0"},{"last_affected":"15.0"},{"introduced":"16.0"},{"last_affected":"16.0"}],"source":"CPE_STRING","vendor_product":"oracle:retail_financial_integration"},{"vendor_product":"oracle:retail_integration_bus","cpes":["cpe:2.3:a:oracle:retail_integration_bus:14.1.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.1.2"},{"last_affected":"14.1.2"}],"source":"CPE_STRING"},{"vendor_product":"oracle:retail_point-of-service","cpes":["cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.0"},{"last_affected":"14.0"},{"introduced":"14.1"},{"last_affected":"14.1"}],"source":"CPE_STRING"},{"source":"CPE_STRING","vendor_product":"oracle:retail_returns_management","cpes":["cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.0"},{"last_affected":"14.0"},{"introduced":"14.1"},{"last_affected":"14.1"}]},{"vendor_product":"oracle:retail_xstore_point_of_service","cpes":["cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"17.0"},{"last_affected":"17.0"}],"source":"CPE_STRING"},{"vendor_product":"oracle:service_architecture_leveraging_tuxedo","cpes":["cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.1.3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.2.2.0.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.3.0.0"},{"last_affected":"12.1.3.0.0"},{"introduced":"12.2.2.0.0"},{"last_affected":"12.2.2.0.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","vendor_product":"oracle:tape_library_acsls","cpes":["cpe:2.3:a:oracle:tape_library_acsls:8.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.4"},{"last_affected":"8.4"}]},{"vendor_product":"oracle:weblogic_server","cpes":["cpe:2.3:a:oracle:weblogic_server:10.3.6.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:weblogic_server:12.2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"10.3.6.0"},{"last_affected":"10.3.6.0"},{"introduced":"12.1.3.0"},{"last_affected":"12.1.3.0"},{"introduced":"12.2.1.2"},{"last_affected":"12.2.1.2"},{"introduced":"12.2.1.3"},{"last_affected":"12.2.1.3"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"7.3.0"},{"last_affected":"7.3.0"}],"source":"CPE_STRING","vendor_product":"redhat:fuse","cpes":["cpe:2.3:a:redhat:fuse:7.3.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/104222"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1041888"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1041896"},{"type":"ADVISORY","url":"https://pivotal.io/security/cve-2018-1258"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20181018-0002/"},{"type":"FIX","url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"},{"type":"FIX","url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"},{"type":"FIX","url":"https://access.redhat.com/errata/RHSA-2019:2413"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2020.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujul2020.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"},{"type":"FIX","url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"},{"type":"FIX","url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"},{"type":"FIX","url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/spring-projects/spring-framework","events":[{"introduced":"0"},{"fixed":"3767abea3a9ec4b76257c1f98d65bd9da57afd28"},{"introduced":"ac107d0c2ae939c669ba086c2874d02790519b06"},{"last_affected":"201b2d752efc4c79b0d52d90e95dac1093520d5f"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*","cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:health_sciences_information_manager:3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:healthcare_master_person_index:3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:healthcare_master_person_index:4.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"7.0.0.1"},{"introduced":"3.1.0"},{"last_affected":"3.1.0"},{"introduced":"3.2.0"},{"last_affected":"3.2.0"},{"introduced":"3.0"},{"last_affected":"3.0"},{"introduced":"4.0"},{"last_affected":"4.0"},{"introduced":"4.2.0"},{"last_affected":"4.2.0"},{"introduced":"4.2.1"},{"last_affected":"4.2.1"}]}}],"versions":["3.0","3.1.0","3.2.0","4.0","4.2.0","4.2.1","v4.2.1.RELEASE","v4.0.0.RC2","v4.0.0.RC1","v4.0.0.M3","v4.0.0.M2","v4.0.0.M1","v3.2.0.RELEASE","v3.2.0.RC2-A","v3.2.0.RC1","v3.2.0.M2","v3.2.0.M1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1258.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}