CVE:CVE-2018-1272
CNNVD:CNNVD-201804-243
Pivotal Software Spring Framework是美国Pivotal Software公司的一套开源的Java、JavaEE应用程序框架。该框架可帮助开发人员构建高质量的应用。
Pivotal Software Spring Framework 5.0.5之前的5.0 版本、4.3.15之前的4.3 版本和不再支持的老版本中存在权限许可和访问控制问题漏洞。远程攻击者可通过发送特制的请求利用该漏洞获取提升的权限。
solution:Upgrade vmware spring_framework to a higher version than 4.3.15,5.0.5,and avoid the version [4.3.0,4.3.15),[5.0,5.0.5); Upgrade oracle application_testing_suite to a higher version than 12.5.0.3,13.1.0.1,13.2.0.1,13.3.0.1,and avoid the version 12.5.0.3,13.1.0.1,13.2.0.1,13.3.0.1; Upgrade oracle big_data_discovery to a higher version than 1.6.0,and avoid the version 1.6.0; Upgrade oracle communications_converged_application_server to a higher version than 7.0.0.1,and avoid the version (,7.0.0.1); Upgrade oracle communications_diameter_signaling_router to a higher version than 8.3,and avoid the version (,8.3); Upgrade oracle communications_performance_intelligence_center to a higher version than 10.2.1,and avoid the version (,10.2.1); Upgrade oracle communications_services_gatekeeper to a higher version than 6.1.0.4.0,and avoid the version (,6.1.0.4.0); Upgrade oracle enterprise_manager_ops_center to a higher version than 12.2.2,12.3.3,and avoid the version 12.2.2,12.3.3; Upgrade oracle goldengate_for_big_data to a higher version than 12.2.0.1,12.3.1.1,12.3.2.1,and avoid the version 12.2.0.1,12.3.1.1,12.3.2.1; Upgrade oracle health_sciences_information_manager to a higher version than 3.0,and avoid the version 3.0; Upgrade oracle healthcare_master_person_index to a higher version than 3.0,4.0,and avoid the version 3.0,4.0; Upgrade oracle insurance_calculation_engine to a higher version than 10.1.1,10.2,10.2.1,and avoid the version 10.1.1,10.2,10.2.1; Upgrade oracle insurance_rules_palette to a higher version than 10.0,10.1,10.2,11.0,11.1,and avoid the version 10.0,10.1,10.2,11.0,11.1; Upgrade oracle primavera_gateway to a higher version than 15.2,16.2,17.12,and avoid the version 15.2,16.2,17.12; Upgrade oracle retail_back_office to a higher version than 14.0,14.1,and avoid the version 14.0,14.1; Upgrade oracle retail_central_office to a higher version than 14.0,14.1,and avoid the version 14.0,14.1; Upgrade oracle retail_customer_insights to a higher version than 15.0,16.0,and avoid the version 15.0,16.0; Upgrade oracle retail_integration_bus to a higher version than 14.0.1,14.0.2,14.0.3,14.0.4,14.1.1,14.1.2,14.1.3,15.0.0.1,15.0.1,15.0.2,16.0,16.0.1,16.0.2,and avoid the version 14.0.1,14.0.2,14.0.3,14.0.4,14.1.1,14.1.2,14.1.3,15.0.0.1,15.0.1,15.0.2,16.0,16.0.1,16.0.2; Upgrade oracle retail_open_commerce_platform to a higher version than 5.3.0,6.0.0,6.0.1,and avoid the version 5.3.0,6.0.0,6.0.1; Upgrade oracle retail_order_broker to a higher version than 5.1,5.2,15.0,16.0,and avoid the version 5.1,5.2,15.0,16.0; Upgrade oracle retail_point-of-sale to a higher version than 14.0,14.1,and avoid the version 14.0,14.1; Upgrade oracle retail_predictive_application_server to a higher version than 14.0,14.1,15.0,16.0,and avoid the version 14.0,14.1,15.0,16.0; Upgrade oracle retail_returns_management to a higher version than 14.0,14.1,and avoid the version 14.0,14.1; Upgrade oracle service_architecture_leveraging_tuxedo to a higher version than 12.1.3.0.0,12.2.2.0.0,and avoid the version 12.1.3.0.0,12.2.2.0.0; Upgrade oracle tape_library_acsls to a higher version than 8.4,and avoid the version 8.4