Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-11040

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

Published

2018-06-25T15:29:00.363

Last Modified

2024-11-21T03:42:32.900

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-829
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application vmware spring_framework < 4.3.18 Yes
Application vmware spring_framework < 5.0.7 Yes
Application oracle agile_product_lifecycle_management 9.3.3 Yes
Application oracle agile_product_lifecycle_management 9.3.4 Yes
Application oracle agile_product_lifecycle_management 9.3.5 Yes
Application oracle application_testing_suite 12.5.0.3 Yes
Application oracle application_testing_suite 13.1.0.1 Yes
Application oracle application_testing_suite 13.2.0.1 Yes
Application oracle application_testing_suite 13.3.0.1 Yes
Application oracle communications_network_integrity ≤ 7.3.6 Yes
Application oracle communications_online_mediation_controller 6.1 Yes
Application oracle communications_services_gatekeeper < 6.1.0.4.0 Yes
Application oracle communications_unified_inventory_management 7.3.2 Yes
Application oracle communications_unified_inventory_management 7.3.4 Yes
Application oracle communications_unified_inventory_management 7.3.5 Yes
Application oracle communications_unified_inventory_management 7.4.0 Yes
Application oracle endeca_information_discovery_integrator 3.1.0 Yes
Application oracle endeca_information_discovery_integrator 3.2.0 Yes
Application oracle enterprise_manager 13.2 Yes
Application oracle enterprise_manager_ops_center 12.3.3 Yes
Application oracle flexcube_private_banking 2.0.0.0 Yes
Application oracle flexcube_private_banking 2.2.0.1 Yes
Application oracle flexcube_private_banking 12.0.1.0 Yes
Application oracle flexcube_private_banking 12.0.3.0 Yes
Application oracle flexcube_private_banking 12.1.0.0 Yes
Application oracle healthcare_master_person_index 3.0 Yes
Application oracle healthcare_master_person_index 4.0 Yes
Application oracle hospitality_guest_access 4.2.0 Yes
Application oracle hospitality_guest_access 4.2.1 Yes
Application oracle insurance_calculation_engine ≤ 11.3.1 Yes
Application oracle insurance_rules_palette 10.0 Yes
Application oracle insurance_rules_palette 10.2 Yes
Application oracle micros_lucas 2.9.5 Yes
Application oracle mysql_enterprise_monitor ≤ 3.4.9.4237 Yes
Application oracle mysql_enterprise_monitor ≤ 4.0.6.5281 Yes
Application oracle mysql_enterprise_monitor ≤ 8.0.2.8191 Yes
Application oracle product_lifecycle_management 9.3.6 Yes
Application oracle retail_advanced_inventory_planning 15.0 Yes
Application oracle retail_clearance_optimization_engine 14.0.5 Yes
Application oracle retail_customer_insights 15.0 Yes
Application oracle retail_customer_insights 16.0 Yes
Application oracle retail_markdown_optimization 13.4.4 Yes
Application oracle retail_predictive_application_server 14.0.3.26 Yes
Application oracle retail_predictive_application_server 14.1.3.37 Yes
Application oracle retail_predictive_application_server 15.0.3.100 Yes
Application oracle retail_predictive_application_server 16.0 Yes
Application oracle retail_service_backbone 16.0.1 Yes
Application oracle retail_xstore_point_of_service 7.1 Yes
Application oracle utilities_network_management_system 1.12.0.3 Yes
Application oracle weblogic_server 12.2.1.3.0 Yes
Operating System debian debian_linux 9.0 Yes
References