Homepage

CVE-2018-1272 The advisory has been revoked - it doesn't affect any version of package libspring-java  (opens in a new tab)

Threat Intelligence

EPSS
3.07% (87th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1804-LIBSPRINGJAVA-614581
  • published10 Sept 2020
  • disclosed6 Apr 2018
Report a new vulnerability Found a mistake?

Introduced: 6 Apr 2018

CVE-2018-1272  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:18.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libspring-java package and not the libspring-java package as distributed by Ubuntu.

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.