CVE-2018-1272: Privilege Escalation in org.springframework:spring-core

org.springframework:spring-core Updated 02 Oct 2025

Summary

17/10/2018

Disclosed on

CVE-2018-1272

CVE

Yes i

Fix available

High

Severity

7.5

CVSS Score

CVE-2018-1272: Possible privilege escalation in org.springframework:spring-core. Affects org.springframework:spring-core across 2 version ranges.

< 4.3.15 >= 5.0.0, < 5.0.5

Fixed in 4.3.15 or 5.0.5, depending on the release line you run. How to fix ↓

Also tracked for

libspring-java · Debian:11

The same CVE-2018-1272 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The org.springframework:spring-core package is a core component of the Spring Framework, which provides support for building Java applications. It includes various utilities and classes for dependency injection, resource handling, and other common tasks. This package is widely used in enterprise applications and provides essential functionality for Spring-based projects.

Vulnerability Detail

The vulnerability (CVE-2018-1272) affects versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 of the org.springframework:spring-core package. It involves client-side support for multipart requests in Spring MVC or Spring WebFlux server applications. When a remote client sends input to the server (server A), which is then used to make a multipart request to another server (server B), an attacker can insert an extra multipart in the request content from server A. This can lead to privilege escalation if the inserted part represents sensitive information such as a username or user roles. The vulnerability can be exploited to manipulate the behavior of server B and potentially gain unauthorized access or perform unauthorized actions.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

< 4.3.15 4.3.15
>= 5.0.0, < 5.0.5 5.0.5

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of the org.springframework:spring-core package.

Conclusion

The vulnerability (CVE-2018-1272) in the org.springframework:spring-core package can lead to privilege escalation and unauthorized access. It is crucial to upgrade to the patched versions of the package (4.3.15 or later for Spring 4.3.x, and 5.0.5 or later for Spring 5.0.x) to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for org.springframework:spring-core →