CVE-2018-1271 in vmware spring framework
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Affected software: vmware spring framework, oracle application testing suite, oracle big data discovery, oracle communications converged application server, oracle communications diameter signaling router, oracle communications performance intelligence center, oracle communications policy management, oracle communications services gatekeeper, oracle enterprise manager ops center, oracle goldengate for big data
Scores
- CVSS: 5.9 (medium)
- EPSS: 30.34% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2018-04-06
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.