Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2018-1196

Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and e

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
dell

Description

Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the "run_user" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the "run_user" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Dell EMC Spring Boot

  • 1.5.0 - 1.5.9affected
  • 2.0.0.M1 - 2.0.0.M7affected

References