CVE-2018-1272: Oracle Application Testing Suite

High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days.

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

Affected products

Oracle Application Testing Suite: version 12.5.0.3 only; version 13.1.0.1 only; version 13.2.0.1 only; version 13.3.0.1 only
Oracle Big Data Discovery: version 1.6.0 only
Oracle Communications Converged Application Server: before 7.0.0.1 (fixed in 7.0.0.1)
Oracle Communications Diameter Signaling Router: before 8.3 (fixed in 8.3)
Oracle Communications Performance Intelligence Center: before 10.2.1 (fixed in 10.2.1)
Oracle Communications Services Gatekeeper: before 6.1.0.4.0 (fixed in 6.1.0.4.0)
Oracle Enterprise Manager Ops Center: version 12.2.2 only; version 12.3.3 only
Oracle Goldengate For Big Data: version 12.2.0.1 only; version 12.3.1.1 only; version 12.3.2.1 only
Oracle Health Sciences Information Manager: version 3.0 only
Oracle Healthcare Master Person Index: version 3.0 only; version 4.0 only
Oracle Insurance Calculation Engine: version 10.1.1 only; version 10.2 only; version 10.2.1 only
Oracle Insurance Rules Palette: version 10.0 only; version 10.1 only; version 10.2 only; version 11.0 only; version 11.1 only
Oracle Primavera Gateway: version 15.2 only; version 16.2 only; version 17.12 only
Oracle Retail Back Office: version 14.0 only; version 14.1 only
Oracle Retail Central Office: version 14.0 only; version 14.1 only
Oracle Retail Customer Insights: version 15.0 only; version 16.0 only
Oracle Retail Integration Bus: version 14.0.1 only; version 14.0.2 only; version 14.0.3 only; version 14.0.4 only; version 14.1.1 only; version 14.1.2 only; …
Oracle Retail Open Commerce Platform: version 5.3.0 only; version 6.0.0 only; version 6.0.1 only
Oracle Retail Order Broker: version 5.1 only; version 5.2 only; version 15.0 only; version 16.0 only
Oracle Retail Point-Of-Sale: version 14.0 only; version 14.1 only
Oracle Retail Predictive Application Server: version 14.0 only; version 14.1 only; version 15.0 only; version 16.0 only
Oracle Retail Returns Management: version 14.0 only; version 14.1 only
Oracle Service Architecture Leveraging Tuxedo: version 12.1.3.0.0 only; version 12.2.2.0.0 only
Oracle Tape Library Acsls: version 8.4 only
VMware Spring Framework: from 4.3.0, before 4.3.15 (fixed in 4.3.15); from 5.0, before 5.0.5 (fixed in 5.0.5)

Published 2018-04-06. Last modified 2026-06-17.