{"cve":"CVE-2018-1258","nvd":{"published":"2018-05-11T20:29:00.260","modified":"2026-08-25T16:28:27.310","status":"Modified","description":"Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-863"],"references":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104222","http://www.securitytracker.com/id/1041888","http://www.securitytracker.com/id/1041896"],"products":["netapp:oncommand_insight","netapp:oncommand_unified_manager","netapp:oncommand_workflow_automation","netapp:snapcenter","netapp:storage_automation_store","oracle:agile_product_lifecycle_management","oracle:application_testing_suite","oracle:big_data_discovery","oracle:communications_converged_application_server","oracle:communications_diameter_signaling_router","oracle:communications_network_integrity","oracle:communications_performance_intelligence_center","oracle:communications_services_gatekeeper","oracle:endeca_information_discovery_integrator","oracle:enterprise_manager_for_mysql_database","oracle:enterprise_manager_ops_center","oracle:enterprise_repository","oracle:goldengate_for_big_data","oracle:health_sciences_information_manager","oracle:healthcare_master_person_index","oracle:hospitality_guest_access","oracle:insurance_calculation_engine","oracle:insurance_policy_administration","oracle:insurance_rules_palette","oracle:micros_lucas","oracle:mysql_enterprise_monitor","oracle:peoplesoft_enterprise_fin_install","oracle:retail_assortment_planning","oracle:retail_back_office","oracle:retail_central_office","oracle:retail_customer_insights","oracle:retail_financial_integration","oracle:retail_integration_bus","oracle:retail_point-of-service","oracle:retail_returns_management","oracle:retail_xstore_point_of_service","oracle:service_architecture_leveraging_tuxedo","oracle:tape_library_acsls","oracle:weblogic_server","pivotal_software:spring_security","redhat:fuse","vmware:spring_framework"],"source":"nvd","synced_at":"2026-10-19T20:50:40.212176939+00:00"},"epss":{"cve":"CVE-2018-1258","score":0.02461,"percentile":0.84455,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-cxrj-66c5-9fmh","url":"https://osv.dev/vulnerability/GHSA-cxrj-66c5-9fmh","summary":"Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass","modified":"2024-03-14T21:08:21Z","packages":[{"ecosystem":"Maven","name":"org.springframework:spring-core","purl":"pkg:maven/org.springframework/spring-core","ranges":[">=5.0.5.RELEASE <5.0.6.RELEASE"],"fixed":["5.0.6.RELEASE"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}