CVE-2018-1270

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-358

Affected software

VendorProductVersions
Spring by PivotalSpring FrameworkVersions prior to 5.0.5 and 4.3.15

References

Timeline

Published
Apr 6, 2018
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-127027.5The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem (GVE), an Ethereum ERC20 token, allows attackCVE-2018-127037.5The approveAndCallcode function of a smart contract implementation for Block 18 (18T), an tradable Ethereum ERC20 token, allows attackers toCVE-2018-127056.1DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side).CVE-2018-127069.8DIGISOL DG-BR4000NG devices have a Buffer Overflow via a long Authorization HTTP header.CVE-2018-12715.9Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configuCVE-2018-127108.0An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilegCVE-2018-127116.1An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the currCVE-2018-127128.8An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_existCVE-2018-127139.1GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonCVE-2018-127149.8An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with noCVE-2018-127156.1DIGISOL DG-HR3400 devices have XSS via a modified SSID when the apssid value is unchanged.CVE-2018-127164.3The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_resu
CVE-2018-1270: Critical severity, CVSS 9.8 | Vulnix