CVE-2018-11039
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
- Score
- CVSS 3.1 5.9 Medium
- Status
- Modified - security_alert@emc.com
- Published
- 2018-06-25
- Last modified
- 2026-10-08
Affected products
- Debian Linux (Debian)
- Agile Product Lifecycle Management (Oracle)
- Application Testing Suite (Oracle)
- Communications Diameter Signaling Router (Oracle)
- Communications Network Integrity (Oracle)
- Communications Online Mediation Controller (Oracle)
- Communications Performance Intelligence Center (Oracle)
- Communications Services Gatekeeper (Oracle)
- Communications Unified Inventory Management (Oracle)
- Endeca Information Discovery Integrator (Oracle)
- Enterprise Manager Base Platform (Oracle)
- Enterprise Manager For Mysql Database (Oracle)
- Enterprise Manager Ops Center (Oracle)
- Health Sciences Information Manager (Oracle)
- Healthcare Master Person Index (Oracle)
- Hospitality Guest Access (Oracle)
- Insurance Calculation Engine (Oracle)
- Insurance Rules Palette (Oracle)
- Micros Lucas (Oracle)
- Mysql Enterprise Monitor (Oracle)
- Primavera P6 Enterprise Project Portfolio Management (Oracle)
- Retail Advanced Inventory Planning (Oracle)
- Retail Assortment Planning (Oracle)
- Retail Clearance Optimization Engine (Oracle)
- Retail Customer Insights (Oracle)
- Retail Financial Integration (Oracle)
- Retail Integration Bus (Oracle)
- Retail Markdown Optimization (Oracle)
- Retail Predictive Application Server (Oracle)
- Retail Xstore Point Of Service (Oracle)
- Utilities Network Management System (Oracle)
- Weblogic Server (Oracle)
- Spring Framework (Pivotal)
- Spring Framework (Vmware)
References
- http://www.securityfocus.com/bid/107984
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://pivotal.io/security/cve-2018-11039
- https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
