Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-11039

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

Published

2018-06-25T15:29:00.317

Last Modified

2024-11-21T03:42:32.633

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application vmware spring_framework < 4.3.18 Yes
Application vmware spring_framework < 5.0.7 Yes
Application oracle agile_plm 9.3.3 Yes
Application oracle agile_plm 9.3.4 Yes
Application oracle agile_plm 9.3.5 Yes
Application oracle agile_plm 9.3.6 Yes
Application oracle application_testing_suite 12.5.0.3 Yes
Application oracle application_testing_suite 13.1.0.1 Yes
Application oracle application_testing_suite 13.2.0.1 Yes
Application oracle application_testing_suite 13.3.0.1 Yes
Application oracle communications_diameter_signaling_router < 8.3 Yes
Application oracle communications_network_integrity ≤ 7.3.6 Yes
Application oracle communications_online_mediation_controller 6.1 Yes
Application oracle communications_performance_intelligence_center < 10.2.1 Yes
Application oracle communications_services_gatekeeper < 6.1.0.4.0 Yes
Application oracle communications_unified_inventory_management 7.3.2 Yes
Application oracle communications_unified_inventory_management 7.3.4 Yes
Application oracle communications_unified_inventory_management 7.3.5 Yes
Application oracle communications_unified_inventory_management 7.4.0 Yes
Application oracle endeca_information_discovery_integrator 3.1.0 Yes
Application oracle endeca_information_discovery_integrator 3.2.0 Yes
Application oracle enterprise_manager_base_platform 12.1.0.5.0 Yes
Application oracle enterprise_manager_base_platform 13.2.0.0.0 Yes
Application oracle enterprise_manager_base_platform 13.3.0.0.0 Yes
Application oracle enterprise_manager_for_mysql_database 13.2 Yes
Application oracle enterprise_manager_ops_center 12.3.3 Yes
Application oracle health_sciences_information_manager 3.0 Yes
Application oracle healthcare_master_person_index 3.0 Yes
Application oracle healthcare_master_person_index 4.0 Yes
Application oracle hospitality_guest_access 4.2.0 Yes
Application oracle hospitality_guest_access 4.2.1 Yes
Application oracle insurance_calculation_engine ≤ 11.3.1 Yes
Application oracle insurance_calculation_engine 10.2 Yes
Application oracle insurance_rules_palette 10.0 Yes
Application oracle insurance_rules_palette 10.2 Yes
Application oracle micros_lucas 2.9.5 Yes
Application oracle mysql_enterprise_monitor ≤ 3.4.9.4237 Yes
Application oracle mysql_enterprise_monitor ≤ 4.0.6.5281 Yes
Application oracle mysql_enterprise_monitor ≤ 8.0.2.8191 Yes
Application oracle primavera_p6_enterprise_project_portfolio_management 18.8 Yes
Application oracle retail_advanced_inventory_planning 15.0 Yes
Application oracle retail_assortment_planning 14.1 Yes
Application oracle retail_assortment_planning 15.0 Yes
Application oracle retail_assortment_planning 16.0 Yes
Application oracle retail_clearance_optimization_engine 14.0.5 Yes
Application oracle retail_customer_insights 15.0 Yes
Application oracle retail_customer_insights 16.0 Yes
Application oracle retail_financial_integration 13.2 Yes
Application oracle retail_financial_integration 14.0 Yes
Application oracle retail_financial_integration 14.1 Yes
Application oracle retail_financial_integration 15.0 Yes
Application oracle retail_financial_integration 16.0 Yes
Application oracle retail_integration_bus 14.1.2 Yes
Application oracle retail_markdown_optimization 13.4.4 Yes
Application oracle retail_predictive_application_server 14.0.3.26 Yes
Application oracle retail_predictive_application_server 14.1.3.37 Yes
Application oracle retail_predictive_application_server 15.0.3..100 Yes
Application oracle retail_predictive_application_server 16.0 Yes
Application oracle retail_xstore_point_of_service 7.1 Yes
Application oracle utilities_network_management_system 1.12.0.3 Yes
Application oracle weblogic_server 10.3.6.0.0 Yes
Application oracle weblogic_server 12.1.3.0.0 Yes
Application oracle weblogic_server 12.2.1.3.0 Yes
Operating System debian debian_linux 9.0 Yes
References