● CVE — Medium
CVE-2018-1257
Vendorredhat, oracle, vmwareProductopenshift, communications unified inventory management, hospitality guest access, agile product lifecycle management, communications converged application server, communications services gatekeeper, enterprise manager ops center, communications diameter signaling router, spring framework, application testing suite, big data discovery, communications performance intelligence center, goldengate for big data, health sciences information manager, healthcare master person index, insurance calculation engine, insurance rules palette, primavera gateway, retail customer insights, retail open commerce platform, retail order broker, enterprise manager base platform, flexcube private banking, endeca information discovery integrator, enterprise manager for mysql databaseDiscoveredMay 11, 2018UpdatedNov 21, 2024
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.