CVE-2018-1258 Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass

What is CVE-2018-1258?

CVE-2018-1258 is a high-severity authentication bypass vulnerability in Netapp Oncommand Insight, published on 11 May 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

Weakness: CWE-863

Which versions are affected by CVE-2018-1258?

2 open source packages ship an affected version, including org.springframework:spring-core. It affects 42 products.

Products include Netapp Oncommand Insight, Netapp Oncommand Unified Manager, Netapp Oncommand Workflow Automation, Netapp Snapcenter, Netapp Storage Automation Store, Oracle Agile Product Lifecycle Management and 36 more.

How do I fix CVE-2018-1258?

Upgrade org.springframework:spring-core to 5.0.6.RELEASE or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-1258 being exploited?

There is no known exploitation of CVE-2018-1258 in the wild and no public exploit code.

Other vulnerabilities in Netapp Oncommand Insight

• CVE-2017-5600 Hardcoded credentials in n/a Critical 9.8
• CVE-2020-5421 RFD Protection Bypass via jsessionid High 8.7
• CVE-2022-38733 Auth bypass in OnCommand Insight High 8.6
• CVE-2023-22102 MySQL Connectors takeover vulnerability High 8.3
• CVE-2021-35583 Denial of service in MySQL Server High 7.5

All Netapp Oncommand Insight vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cxrj-66c5-9fmh.