Improper input validation in Dell EMC Spring by Pivotal
Priority LOW 29CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 1 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.
Why it matters now
EPSS 0.02803 86th percentileScored 2026-11-07
Fix Partial org.springframework.security:spring-security-core (Maven): 4.2.4, 5.0.1, 4.1.5org.springframework:spring-core (Maven): 4.3.14, 5.0.3Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell EMC | Spring by Pivotal | spring Security 4.1.0 - 4.1.4, 4.2.0 - 4.2.3, 5.0.0; Spring Framework 5.0.0 - 5.0.2, 4.3.0 - 4.3.13; Older unmaintained versions of Spring Security & Spring Framework were not analyzed and may be impacted | — | No fix listed | CNA |
| — | org.springframework.security:spring-security-core (Maven) | 4.2.0 to before 4.2.4 | 4.2.4 | Patch available | GHSA-v596-fwhq-8x48 |
| — | org.springframework.security:spring-security-core (Maven) | 5.0.0 to before 5.0.1 | 5.0.1 | Patch available | GHSA-v596-fwhq-8x48 |
| — | org.springframework:spring-core (Maven) | 4.3.0 to before 4.3.14 | 4.3.14 | Patch available | GHSA-v596-fwhq-8x48 |
| — | org.springframework:spring-core (Maven) | 5.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-v596-fwhq-8x48 |
| — | org.springframework.security:spring-security-core (Maven) | 4.1.0 to before 4.1.5 | 4.1.5 | Patch available | GHSA-v596-fwhq-8x48 |
- Spring by Pivotal VendorDell EMC Affected spring Security 4.1.0 - 4.1.4, 4.2.0 - 4.2.3, 5.0.0; Spring Framework 5.0.0 - 5.0.2, 4.3.0 - 4.3.13; Older unmaintained versions of Spring Security & Spring Framework were not analyzed and may be impacted Fixed in — No fix listed CNA
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 4.2.0 to before 4.2.4 Fixed in 4.2.4 Patch available GHSA-v596-fwhq-8x48
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.0.0 to before 5.0.1 Fixed in 5.0.1 Patch available GHSA-v596-fwhq-8x48
- org.springframework:spring-core (Maven) Vendor— Affected 4.3.0 to before 4.3.14 Fixed in 4.3.14 Patch available GHSA-v596-fwhq-8x48
- org.springframework:spring-core (Maven) Vendor— Affected 5.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-v596-fwhq-8x48
- org.springframework.security:spring-security-core (Maven) Vendor— Affected 4.1.0 to before 4.1.5 Fixed in 4.1.5 Patch available GHSA-v596-fwhq-8x48
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* | 4.3.0 to before 4.3.14; 5.0.0 to before 5.0.3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* | 4.1.0 to before 4.1.5; 4.2.0 to before 4.2.4; 5.0.0 to before 5.0.1 | Vulnerable | VMware |
| cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Red Hat |
| cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:* | 12.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:* | 12.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Oracle |
- cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions 4.3.0 to before 4.3.14; 5.0.0 to before 5.0.3 Vulnerable ·VMware
- cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* Versions 4.1.0 to before 4.1.5; 4.2.0 to before 4.2.4; 5.0.0 to before 5.0.1 Vulnerable ·VMware
- cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
- cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:* Versions 12.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
Remediation
- Fix · GHSA-v596-fwhq-8x48 org.springframework.security:spring-security-core (Maven) Fixed in 4.2.4 Advisory →
- Fix · GHSA-v596-fwhq-8x48 org.springframework.security:spring-security-core (Maven) Fixed in 5.0.1 Advisory →
- Fix · GHSA-v596-fwhq-8x48 org.springframework:spring-core (Maven) Fixed in 4.3.14 Advisory →
- Fix · GHSA-v596-fwhq-8x48 org.springframework:spring-core (Maven) Fixed in 5.0.3 Advisory →
- Fix · GHSA-v596-fwhq-8x48 org.springframework.security:spring-security-core (Maven) Fixed in 4.1.5 Advisory →
Red Hat 1 advisory
- RHSA-2018:2405 Released 2018-08-14 · Red Hat rating CriticalRed Hat FIS 2.0 on Fuse 6.3.0 R7 security and bug fix update
- Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat JBoss Fuse Integration Service 2 | Affected | No fix yet |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 11 (Ocata) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 12 (Pike) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix planned: Will not fix |
| Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R7 | Fixed | RHSA-2018:2405 |
Not affected: 16 products
- Red Hat Enterprise Linux 8
- Red Hat JBoss A-MQ 6
- Red Hat JBoss BRMS 5
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 5
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Web Server 2
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Service Works 6
- Red Hat JBoss Portal 6
- Red Hat JBoss SOA Platform 5
- Red Hat JBoss Web Server 3
- Red Hat Mobile Application Platform 4
- Red Hat OpenShift Enterprise 3
- Red Hat Storage 3
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1199
- 2026-10-03 Alias added: GHSA-v596-fwhq-8x48
References
Advisory 5
Other 12
- [activemq-issues] 20190703 [jira] [Created] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework)
- [activemq-issues] 20190703 [jira] [Updated] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework) and xstream-1.4.10.jar
- [activemq-issues] 20190718 [jira] [Updated] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework) and xstream-1.4.10.jar
- https://github.com/spring-projects/spring-framework/commit/554662ebab87af97ba25d0c9f5449c7acda8df9c
- https://github.com/spring-projects/spring-framework/commit/73a81f98d40eb6f5faa91aceb868db53fae2a94b
- https://github.com/spring-projects/spring-framework/commit/e6e6b8f4adcad99d133de97fcfac5ae5dd14153c
- https://github.com/spring-projects/spring-security/commit/0eef5b4b425ab42b9fa0fde1a3f36a37b92558f
- https://github.com/spring-projects/spring-security/commit/65da28e4bf62f58fb130ba727cbbd621b44a36d
- https://github.com/spring-projects/spring-security/commit/cb8041ba67635edafcc934498ef82707157fd22
- https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E
More Dell EMC vulnerabilities
- TI-2018-01128 Missing authorization in Dell EMC Avamar, Integrated Data Protection Appliance CVSS 3.0CRITICAL 9.8
- TI-2018-01141 OS command injection in Dell EMC RecoverPoint CVSS 3.0CRITICAL 9.8
- TI-2018-07852 Dell EMC Avamar and Integrated Data Protection Appliance Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
- TI-2017-05620 EMC Networker Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
- TI-2018-11243 Dell EMC ESRS Policy Manager versions 6.8 and prior contain a remote code execution… CVSS 3.0CRITICAL 9.8
- TI-2017-08041 OS command injection in Dell EMC Data Protection Advisor CVSS 3.1HIGH 8.8
Sources
- CVE-2018-1199 · CVE Program
- CVE-2018-1199 · NVD
- FIRST EPSS
- GHSA-v596-fwhq-8x48 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1199 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences