Improper input validation in Spring Framework - CVE-2018-15756

Vulnerability identifier: #VU15467

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-15756

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in Pivotal Software Spring Framework due to improper handling of range requests. A remote attacker can send a specially crafted request that contains an additional range header with a high number of ranges or with wide ranges that overlap and cause the service to crash.

Spring Framework
Oracle Healthcare Master Person Index
Dell Support Assist Enterprise
Oracle Communications Online Mediation Controller
Oracle Financial Services Analytical Applications Infrastructure
Oracle Insurance Rules Palette
Oracle FLEXCUBE Private Banking
IBM Engineering Requirements Management DOORS Next
Oracle Endeca Information Discovery Integrator
Oracle Communications Session Route Manager
Identity Manager Connector
Oracle Insurance Policy Administration
Oracle WebCenter Sites
Primavera Analytics
MySQL Enterprise Monitor
Fuse
Oracle WebLogic Server
Primavera Gateway
AMQ Broker
Oracle Communications Unified Inventory Management
Oracle Communications Diameter Signaling Router (DSR)
Oracle Communications Session Report Manager
Autodesk Infraworks
Tape Library ACSLS
Oracle Agile PLM Framework
Oracle Insurance Calculation Engine
Oracle GoldenGate Application Adapters
Enterprise Manager for Fusion Applications
Oracle Retail Financial Integration
Oracle Retail Advanced Inventory Planning
Oracle Retail Integration Bus

The vulnerability has been addressed in the version 4.3.20, 5.0.10, 5.1.1.

Spring Framework - addressed in versions 4.3.20, 5.0.10, 5.1.1
MySQL Enterprise Monitor - addressed in versions 4.0.10, 8.0.16
Dell Support Assist Enterprise - update to 4.00.06.00
Fuse - update to 7.6.0
Oracle Financial Services Analytical Applications Infrastructure - update to 8.0.8.0
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
AMQ Broker - update to 7.4.4
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.7

• https://pivotal.io/security/cve-2018-15756

• Denial of service in Pivotal Software Spring Framework
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Red Hat Fuse
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router (DSR)
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Session Route Manager
• Multiple vulnerabilities in Identity Manager Connector
• Multiple vulnerabilities in Tape Library ACSLS
• Improper input validation in Oracle Healthcare Master Person Index
• Improper input validation in Oracle Retail Integration Bus
• Improper input validation in Oracle GoldenGate Application Adapters
• Improper input validation in Enterprise Manager for Fusion Applications
• Multiple vulnerabilities in Autodesk InfraWorks
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Multiple vulnerabilities in AMQ Broker 7.4
• Multiple vulnerabilities in Primavera Gateway
• Improper input validation in Primavera Analytics
• Multiple vulnerabilities in Oracle Communications Online Mediation Controller
• Multiple vulnerabilities in Oracle WebCenter Sites
• Multiple vulnerabilities in Oracle WebLogic Server
• Improper input validation in Oracle Endeca Information Discovery Integrator
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Multiple vulnerabilities in Oracle FLEXCUBE Private Banking
• Multiple vulnerabilities in Oracle Insurance Calculation Engine
• Multiple vulnerabilities in Oracle Insurance Policy Administration
• Multiple vulnerabilities in Oracle Insurance Rules Palette
• Improper input validation in Oracle Retail Advanced Inventory Planning
• Improper input validation in Oracle Retail Financial Integration
• Improper input validation in MySQL Enterprise Monitor
• Multiple vulnerabilities in Oracle Agile PLM Framework