CVE-2018-11039

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
dellCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 85%
VendorProductVersion
vmwarespring_framework
𝑥
< 4.3.18
vmwarespring_framework
5.0.0 ≤
𝑥
< 5.0.7
oracleagile_plm
9.3.3
oracleagile_plm
9.3.4
oracleagile_plm
9.3.5
oracleagile_plm
9.3.6
oracleapplication_testing_suite
12.5.0.3
oracleapplication_testing_suite
13.1.0.1
oracleapplication_testing_suite
13.2.0.1
oracleapplication_testing_suite
13.3.0.1
oraclecommunications_diameter_signaling_router
𝑥
< 8.3
oraclecommunications_network_integrity
7.3.2 ≤
𝑥
≤ 7.3.6
oraclecommunications_online_mediation_controller
6.1
oraclecommunications_performance_intelligence_center
𝑥
< 10.2.1
oraclecommunications_services_gatekeeper
𝑥
< 6.1.0.4.0
oraclecommunications_unified_inventory_management
7.3.2
oraclecommunications_unified_inventory_management
7.3.4
oraclecommunications_unified_inventory_management
7.3.5
oraclecommunications_unified_inventory_management
7.4.0
oracleendeca_information_discovery_integrator
3.1.0
oracleendeca_information_discovery_integrator
3.2.0
oracleenterprise_manager_base_platform
12.1.0.5.0
oracleenterprise_manager_base_platform
13.2.0.0.0
oracleenterprise_manager_base_platform
13.3.0.0.0
oracleenterprise_manager_for_mysql_database
13.2
oracleenterprise_manager_ops_center
12.3.3
oraclehealth_sciences_information_manager
3.0
oraclehealthcare_master_person_index
3.0
oraclehealthcare_master_person_index
4.0
oraclehospitality_guest_access
4.2.0
oraclehospitality_guest_access
4.2.1
oracleinsurance_calculation_engine
11.0.0 ≤
𝑥
≤ 11.3.1
oracleinsurance_calculation_engine
10.2
oracleinsurance_rules_palette
10.0
oracleinsurance_rules_palette
10.2
oraclemicros_lucas
2.9.5
oraclemysql_enterprise_monitor
𝑥
≤ 3.4.9.4237
oraclemysql_enterprise_monitor
4.0.0 ≤
𝑥
≤ 4.0.6.5281
oraclemysql_enterprise_monitor
8.0.0 ≤
𝑥
≤ 8.0.2.8191
oracleprimavera_p6_enterprise_project_portfolio_management
18.8
oracleretail_advanced_inventory_planning
15.0
oracleretail_assortment_planning
14.1
oracleretail_assortment_planning
15.0
oracleretail_assortment_planning
16.0
oracleretail_clearance_optimization_engine
14.0.5
oracleretail_customer_insights
15.0
oracleretail_customer_insights
16.0
oracleretail_financial_integration
13.2
oracleretail_financial_integration
14.0
oracleretail_financial_integration
14.1
oracleretail_financial_integration
15.0
oracleretail_financial_integration
16.0
oracleretail_integration_bus
14.1.2
oracleretail_markdown_optimization
13.4.4
oracleretail_predictive_application_server
14.0.3.26
oracleretail_predictive_application_server
14.1.3.37
oracleretail_predictive_application_server
15.0.3..100
oracleretail_predictive_application_server
16.0
oracleretail_xstore_point_of_service
7.1
oracleutilities_network_management_system
1.12.0.3
oracleweblogic_server
10.3.6.0.0
oracleweblogic_server
12.1.3.0.0
oracleweblogic_server
12.2.1.3.0
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libspring-java
bullseye
4.3.30-1
fixed
jessie
no-dsa
sid
4.3.30-2
fixed
trixie
4.3.30-2
fixed
bookworm
4.3.30-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libspring-java
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
not-affected
focal
not-affected
eoan
not-affected
disco
not-affected
cosmic
not-affected
bionic
not-affected
artful
ignored
xenial
needed
trusty
needed
References
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.securityfocus.com/bid/107984
https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
https://pivotal.io/security/cve-2018-11039
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.securityfocus.com/bid/107984
https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
https://pivotal.io/security/cve-2018-11039
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html