Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2018-1270

critical

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocke…

Vendor / product: Vmware — spring framework

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2018-04-06 13:29
Modified: 2026-10-08 22:16
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

vmware / spring_framework <4.3.16, ≥5.0.0 <5.0.5
oracle / application_testing_suite 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1
oracle / big_data_discovery 1.6.0
oracle / communications_converged_application_server <7.0.0.1
oracle / communications_diameter_signaling_router <8.3
oracle / communications_performance_intelligence_center <10.2.1
oracle / communications_services_gatekeeper <6.1.0.4.0
oracle / enterprise_manager_ops_center 12.2.2, 12.3.3
oracle / goldengate_for_big_data 12.2.0.1, 12.3.1.1, 12.3.2.1
oracle / health_sciences_information_manager 3.0
oracle / healthcare_master_person_index 3.0, 4.0
oracle / insurance_calculation_engine 10.1.1, 10.2, 10.2.1
oracle / insurance_rules_palette 10.0, 10.1, 10.2, 11.0, 11.1
oracle / primavera_gateway 15.2, 16.2, 17.12
oracle / retail_back_office 14.0, 14.1
oracle / retail_central_office 14.0, 14.1
oracle / retail_customer_insights 15.0, 16.0
oracle / retail_integration_bus 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.1.1, 14.1.2
oracle / retail_open_commerce_platform 5.3.0, 6.0.0, 6.0.1
oracle / retail_order_broker 5.1, 5.2, 15.0, 16.0
oracle / retail_point-of-sale 14.0, 14.1
oracle / retail_predictive_application_server 14.0, 14.1, 15.0, 16.0
oracle / retail_returns_management 14.0, 14.1
oracle / retail_xstore_point_of_service 7.1
oracle / service_architecture_leveraging_tuxedo 12.1.3.0.0, 12.2.2.0.0
oracle / tape_library_acsls 8.4
redhat / fuse 1.0.0
debian / debian_linux 9.0

Weakness classification (CWE)

CWE-94 CWE-358

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://pivotal.io/security/cve-2018-1270
Vendor advisory: https://pivotal.io/security/cve-2018-1270
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpujul2020.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuoct2021.html
Patch / mitigation: https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Patch / mitigation: https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpujul2020.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuoct2021.html

References

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2026-106123CVE-2025-41244CVE-2026-59318CVE-2026-106121CVE-2026-106122