GHSA-4487-x383-qpph CVE-2018-1272

Possible privilege escalation in org.springframework:spring-core

High Maven

Severity: 7.5 / 10; High · CVSS 3.0
Exploit chance (EPSS): 3.06%; Chance of exploitation in the next 30 days. Higher than 87.62% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 4.3.15; Upgrade org.springframework:spring-core to this version or later

Description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

Affected versions

Maven

Package	Vulnerable	Fixed in
org.springframework:spring-core	`< 4.3.15`	`4.3.15`
org.springframework:spring-core	`>= 5.0.0, < 5.0.5`	`5.0.5`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.springframework:spring-core Maven → `4.3.15`

maven

<dependency><groupId>org.springframework</groupId><artifactId>spring-core</artifactId><version>4.3.15</version></dependency>

gradle

implementation("org.springframework:spring-core:4.3.15")

Severity breakdown

CVSS 3.0 7.5

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: High
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

References

Advisories

Timeline

Oct 17, 2018 Published
Dec 5, 2024 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-659m-px2c-25wj Spring Framework Denial of Service via AntPathMatcher	High	Also affects org.springframework:spring-core
GHSA-jmp9-x22r-554x Spring Framework annotation detection mechanism may result in improper authorization	High	Also affects org.springframework:spring-core
GHSA-r4q3-7g4q-x89m Spring Framework server Web DoS Vulnerability	High	Also affects org.springframework:spring-core
GHSA-rfmp-97jj-h8m6 Improper Output Neutralization for Logs in Spring Framework	Medium	Also affects org.springframework:spring-core
GHSA-wv88-pf73-x22p Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework	High	Also affects org.springframework:spring-core
GHSA-f866-m9mv-2xr3 Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data	Medium	Also affects org.springframework:spring-core
GHSA-rhcg-rwhx-qj3j Improper Limitation of a Pathname to a Restricted Directory in Spring Framework	Medium	Also affects org.springframework:spring-core
GHSA-wjjr-h4wh-w6vv Spring Framework Inefficient Regular Expression Complexity	Medium	Also affects org.springframework:spring-core

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor