{"affected":[{"affectedData":[{"product":"Spring Boot","vendor":"Dell EMC","versions":[{"status":"affected","version":"1.5.0 - 1.5.9"},{"status":"affected","version":"2.0.0.M1 - 2.0.0.M7"}]}],"source":"security_alert@emc.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*","matchCriteriaId":"777814DB-A842-44AE-80AA-DAAB0F0C2DE8","versionEndIncluding":"1.5.9","vulnerable":true},{"criteria":"cpe:2.3:a:vmware:spring_boot:2.0.0:milestone1:*:*:*:*:*:*","matchCriteriaId":"141F2C99-AD34-4003-81D4-689F3F1A53ED","vulnerable":true},{"criteria":"cpe:2.3:a:vmware:spring_boot:2.0.0:milestone2:*:*:*:*:*:*","matchCriteriaId":"D7929E66-FCA2-4D1B-B29F-55BF70AF70C2","vulnerable":true},{"criteria":"cpe:2.3:a:vmware:spring_boot:2.0.0:milestone3:*:*:*:*:*:*","matchCriteriaId":"E6B93CDA-E5D9-4955-910A-22B38779F23C","vulnerable":true},{"criteria":"cpe:2.3:a:vmware:spring_boot:2.0.0:milestone4:*:*:*:*:*:*","matchCriteriaId":"F324F68E-CF50-4F2E-90E4-3620CE05A944","vulnerable":true},{"criteria":"cpe:2.3:a:vmware:spring_boot:2.0.0:milestone5:*:*:*:*:*:*","matchCriteriaId":"C120785F-A827-4870-B33B-679367A9EB20","vulnerable":true},{"criteria":"cpe:2.3:a:vmware:spring_boot:2.0.0:milestone6:*:*:*:*:*:*","matchCriteriaId":"4826AF0C-1C00-4E13-88D0-2803A3BC01DC","vulnerable":true},{"criteria":"cpe:2.3:a:vmware:spring_boot:2.0.0:milestone7:*:*:*:*:*:*","matchCriteriaId":"6F6E42D8-3B40-4EC5-ACA4-3055F64A2AD4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the \"run_user\" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the \"run_user\" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible."},{"lang":"es","value":"Spring Boot soporta un script de inicio embebido que puede emplearse para ejecuta fácilmente la aplicación como servicio de linux systemd o init.d. El script incluido con Spring Boot 1.5.9 y anteriores y 2.0.0.M1 hasta 2.0.0.M7 es susceptible a un ataque symlink que permite que \"run_user\" sobrescriba y se haga dueño de cualquier archivo en el mismo sistema. Para instigar el ataque, la aplicación debe estar instalada como servicio y \"run_user\" requiere acceso shell al servidor. Las aplicaciones Spring Boot que no estén instaladas como servicio o que no estén usando el script de inicio embebido no son susceptibles."}],"id":"CVE-2018-1196","lastModified":"2026-06-17T01:50:41.020","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":4.3,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":8.6,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.0"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-03-19T18:29:00.387","references":[{"source":"security_alert@emc.com","tags":["Vendor Advisory"],"url":"https://pivotal.io/security/cve-2018-1196"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://pivotal.io/security/cve-2018-1196"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"nvd@nist.gov","type":"Primary"}]}