--- id: CVE-2018-1258 title: >- Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security summary: >- Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should … severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-863 vendor: pivotal_software product: spring_security affected: - spring_security - spring_framework = 5.0.5 - agile_product_lifecycle_management = 9.3.3 - agile_product_lifecycle_management = 9.3.4 - agile_product_lifecycle_management = 9.3.5 - agile_product_lifecycle_management = 9.3.6 - application_testing_suite = 10.1 - application_testing_suite = 12.5.0.3 - application_testing_suite = 13.1.0.1 - application_testing_suite = 13.2.0.1 - application_testing_suite = 13.3.0.1 - big_data_discovery = 1.6.0 - communications_converged_application_server < 7.0.0.1 - communications_diameter_signaling_router < 8.3 - 'communications_network_integrity >= 7.3.2, <= 7.3.6' - communications_performance_intelligence_center < 10.2.1 - communications_services_gatekeeper < 6.1.0.4.0 - endeca_information_discovery_integrator = 3.1.0 - endeca_information_discovery_integrator = 3.2.0 - enterprise_manager_for_mysql_database = 13.2 - enterprise_manager_ops_center = 12.2.2 - enterprise_manager_ops_center = 12.3.3 - enterprise_repository = 11.1.1.7.0 - enterprise_repository = 12.1.3.0.0 - goldengate_for_big_data = 12.2.0.1 - goldengate_for_big_data = 12.3.1.1 - goldengate_for_big_data = 12.3.2.1 - health_sciences_information_manager = 3.0 - healthcare_master_person_index = 3.0 - healthcare_master_person_index = 4.0 - hospitality_guest_access = 4.2.0 - hospitality_guest_access = 4.2.1 - insurance_calculation_engine = 10.1.1 - insurance_calculation_engine = 10.2 - insurance_calculation_engine = 10.2.1 - insurance_policy_administration = 10.0 - insurance_policy_administration = 10.1 - insurance_policy_administration = 10.2 - insurance_policy_administration = 11.0 - insurance_rules_palette = 10.0 - insurance_rules_palette = 10.1 - insurance_rules_palette = 10.2 - insurance_rules_palette = 11.0 - insurance_rules_palette = 11.1 - micros_lucas = 2.9.5 - mysql_enterprise_monitor <= 8.0.2.8191 - peoplesoft_enterprise_fin_install = 9.2 - retail_assortment_planning = 14.1 - retail_assortment_planning = 15.0 - retail_assortment_planning = 16.0 - retail_back_office = 14.0 - retail_back_office = 14.1 - retail_central_office = 14.0 - retail_central_office = 14.1 - retail_customer_insights = 15.0 - retail_customer_insights = 16.0 - retail_financial_integration = 13.2 - retail_financial_integration = 14.0 - retail_financial_integration = 14.1 - retail_financial_integration = 15.0 - retail_financial_integration = 16.0 - retail_integration_bus = 14.1.2 - retail_point-of-service = 14.0 - retail_point-of-service = 14.1 - retail_returns_management = 14.0 - retail_returns_management = 14.1 - retail_xstore_point_of_service = 17.0 - service_architecture_leveraging_tuxedo = 12.1.3.0.0 - service_architecture_leveraging_tuxedo = 12.2.2.0.0 - tape_library_acsls = 8.4 - weblogic_server = 10.3.6.0 - weblogic_server = 12.1.3.0 - weblogic_server = 12.2.1.2 - weblogic_server = 12.2.1.3 - oncommand_insight - oncommand_unified_manager >= 7.3 - oncommand_unified_manager >= 9.4 - oncommand_workflow_automation - snapcenter - storage_automation_store - fuse = 7.3.0 patched: - communications_converged_application_server 7.0.0.1 - communications_diameter_signaling_router 8.3 - communications_performance_intelligence_center 10.2.1 - communications_services_gatekeeper 6.1.0.4.0 published: '2018-05-11' updated: '2026-08-25' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-1258' references: - url: >- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html label: security_alert@emc.com - url: >- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html label: security_alert@emc.com - url: 'http://www.securityfocus.com/bid/104222' label: security_alert@emc.com - url: 'http://www.securitytracker.com/id/1041888' label: security_alert@emc.com - url: 'http://www.securitytracker.com/id/1041896' label: security_alert@emc.com - url: 'https://access.redhat.com/errata/RHSA-2019:2413' label: security_alert@emc.com - url: 'https://pivotal.io/security/cve-2018-1258' label: security_alert@emc.com - url: 'https://security.netapp.com/advisory/ntap-20181018-0002/' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: security_alert@emc.com - url: >- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html label: security_alert@emc.com - url: >- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html label: security_alert@emc.com - url: >- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html label: security_alert@emc.com - url: >- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securityfocus.com/bid/104222' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securitytracker.com/id/1041888' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securitytracker.com/id/1041896' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:2413' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://pivotal.io/security/cve-2018-1258' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20181018-0002/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.02457 epssPercentile: 0.83604 ingestedAt: '2026-08-25T17:29:29.110Z' --- ## Overview Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted. ## Affected - `spring_security` - `spring_framework = 5.0.5` - `agile_product_lifecycle_management = 9.3.3` - `agile_product_lifecycle_management = 9.3.4` - `agile_product_lifecycle_management = 9.3.5` - `agile_product_lifecycle_management = 9.3.6` - `application_testing_suite = 10.1` - `application_testing_suite = 12.5.0.3` - `application_testing_suite = 13.1.0.1` - `application_testing_suite = 13.2.0.1` - `application_testing_suite = 13.3.0.1` - `big_data_discovery = 1.6.0` - `communications_converged_application_server < 7.0.0.1` - `communications_diameter_signaling_router < 8.3` - `communications_network_integrity >= 7.3.2, <= 7.3.6` - `communications_performance_intelligence_center < 10.2.1` - `communications_services_gatekeeper < 6.1.0.4.0` - `endeca_information_discovery_integrator = 3.1.0` - `endeca_information_discovery_integrator = 3.2.0` - `enterprise_manager_for_mysql_database = 13.2` - `enterprise_manager_ops_center = 12.2.2` - `enterprise_manager_ops_center = 12.3.3` - `enterprise_repository = 11.1.1.7.0` - `enterprise_repository = 12.1.3.0.0` - `goldengate_for_big_data = 12.2.0.1` - `goldengate_for_big_data = 12.3.1.1` - `goldengate_for_big_data = 12.3.2.1` - `health_sciences_information_manager = 3.0` - `healthcare_master_person_index = 3.0` - `healthcare_master_person_index = 4.0` - `hospitality_guest_access = 4.2.0` - `hospitality_guest_access = 4.2.1` - `insurance_calculation_engine = 10.1.1` - `insurance_calculation_engine = 10.2` - `insurance_calculation_engine = 10.2.1` - `insurance_policy_administration = 10.0` - `insurance_policy_administration = 10.1` - `insurance_policy_administration = 10.2` - `insurance_policy_administration = 11.0` - `insurance_rules_palette = 10.0` - `insurance_rules_palette = 10.1` - `insurance_rules_palette = 10.2` - `insurance_rules_palette = 11.0` - `insurance_rules_palette = 11.1` - `micros_lucas = 2.9.5` - `mysql_enterprise_monitor <= 8.0.2.8191` - `peoplesoft_enterprise_fin_install = 9.2` - `retail_assortment_planning = 14.1` - `retail_assortment_planning = 15.0` - `retail_assortment_planning = 16.0` - `retail_back_office = 14.0` - `retail_back_office = 14.1` - `retail_central_office = 14.0` - `retail_central_office = 14.1` - `retail_customer_insights = 15.0` - `retail_customer_insights = 16.0` - `retail_financial_integration = 13.2` - `retail_financial_integration = 14.0` - `retail_financial_integration = 14.1` - `retail_financial_integration = 15.0` - `retail_financial_integration = 16.0` - `retail_integration_bus = 14.1.2` - `retail_point-of-service = 14.0` - `retail_point-of-service = 14.1` - `retail_returns_management = 14.0` - `retail_returns_management = 14.1` - `retail_xstore_point_of_service = 17.0` - `service_architecture_leveraging_tuxedo = 12.1.3.0.0` - `service_architecture_leveraging_tuxedo = 12.2.2.0.0` - `tape_library_acsls = 8.4` - `weblogic_server = 10.3.6.0` - `weblogic_server = 12.1.3.0` - `weblogic_server = 12.2.1.2` - `weblogic_server = 12.2.1.3` - `oncommand_insight` - `oncommand_unified_manager >= 7.3` - `oncommand_unified_manager >= 9.4` - `oncommand_workflow_automation` - `snapcenter` - `storage_automation_store` - `fuse = 7.3.0` ## Remediation Upgrade past the affected range: - `communications_converged_application_server 7.0.0.1` - `communications_diameter_signaling_router 8.3` - `communications_performance_intelligence_center 10.2.1` - `communications_services_gatekeeper 6.1.0.4.0`