CVE-2018-11039 : Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18,

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

Published 2018-06-25 15:29:00

Updated 2022-06-23 16:30:59

Source Dell

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2018-11039

Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Oracle » Weblogic Server » Version: 10.3.6.0.0
cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*
Matching versions
Oracle » Weblogic Server » Version: 12.1.3.0.0
cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*
Matching versions
Oracle » Weblogic Server » Version: 12.2.1.3.0
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Enterprise Monitor
Versions from including (>=) 4.0.0 and up to, including, (<=) 4.0.6.5281
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Enterprise Monitor
Versions up to, including, (<=) 3.4.9.4237
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Enterprise Monitor
Versions from including (>=) 8.0.0 and up to, including, (<=) 8.0.2.8191
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
Matching versions
Oracle » Application Testing Suite » Version: 12.5.0.3
cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*
Matching versions
Oracle » Application Testing Suite » Version: 13.3.0.1
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
Matching versions
Oracle » Application Testing Suite » Version: 13.2.0.1
cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*
Matching versions
Oracle » Application Testing Suite » Version: 13.1.0.1
cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Xstore Point Of Service » Version: 7.1
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Integration Bus » Version: 14.1.2
cpe:2.3:a:oracle:retail_integration_bus:14.1.2:*:*:*:*:*:*:*
Matching versions
Oracle » Enterprise Manager Ops Center » Version: 12.3.3
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*
Matching versions
Oracle » Insurance Rules Palette » Version: 10.0
cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:*
Matching versions
Oracle » Insurance Rules Palette » Version: 10.2
cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:*
Matching versions
Oracle » Primavera P6 Enterprise Project Portfolio Management » Version: 18.8
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:18.8:*:*:*:*:*:*:*
Matching versions
Oracle » Healthcare Master Person Index » Version: 3.0
cpe:2.3:a:oracle:healthcare_master_person_index:3.0:*:*:*:*:*:*:*
Matching versions
Oracle » Healthcare Master Person Index » Version: 4.0
cpe:2.3:a:oracle:healthcare_master_person_index:4.0:*:*:*:*:*:*:*
Matching versions
Oracle » Health Sciences Information Manager » Version: 3.0
cpe:2.3:a:oracle:health_sciences_information_manager:3.0:*:*:*:*:*:*:*
Matching versions
Oracle » Insurance Calculation Engine
Versions from including (>=) 11.0.0 and up to, including, (<=) 11.3.1
cpe:2.3:a:oracle:insurance_calculation_engine:*:*:*:*:*:*:*:*
Matching versions
Oracle » Insurance Calculation Engine » Version: 10.2
cpe:2.3:a:oracle:insurance_calculation_engine:10.2:*:*:*:*:*:*:*
Matching versions
Oracle » Enterprise Manager Base Platform » Version: 13.2.0.0.0
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:*:*:*:*:*:*:*
Matching versions
Oracle » Enterprise Manager Base Platform » Version: 13.3.0.0.0
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:*:*:*:*:*:*:*
Matching versions
Oracle » Enterprise Manager Base Platform » Version: 12.1.0.5.0
cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:*:*:*:*:*:*:*
Matching versions
Oracle » Hospitality Guest Access » Version: 4.2.0
cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*
Matching versions
Oracle » Hospitality Guest Access » Version: 4.2.1
cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Unified Inventory Management » Version: 7.3.4
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Unified Inventory Management » Version: 7.3.5
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Unified Inventory Management » Version: 7.3.2
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.2:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Unified Inventory Management » Version: 7.4.0
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*
Matching versions
Oracle » Endeca Information Discovery Integrator » Version: 3.1.0
cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.1.0:*:*:*:*:*:*:*
Matching versions
Oracle » Endeca Information Discovery Integrator » Version: 3.2.0
cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Diameter Signaling Router
Versions before (<) 8.3
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Customer Insights » Version: 16.0
cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Customer Insights » Version: 15.0
cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Predictive Application Server » Version: 16.0
cpe:2.3:a:oracle:retail_predictive_application_server:16.0:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Predictive Application Server » Version: 14.0.3.26
cpe:2.3:a:oracle:retail_predictive_application_server:14.0.3.26:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Predictive Application Server » Version: 14.1.3.37
cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3.37:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Predictive Application Server » Version: 15.0.3..100
cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3..100:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Assortment Planning » Version: 14.1
cpe:2.3:a:oracle:retail_assortment_planning:14.1:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Assortment Planning » Version: 15.0
cpe:2.3:a:oracle:retail_assortment_planning:15.0:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Assortment Planning » Version: 16.0
cpe:2.3:a:oracle:retail_assortment_planning:16.0:*:*:*:*:*:*:*
Matching versions
Oracle » Enterprise Manager For Mysql Database » Version: 13.2
cpe:2.3:a:oracle:enterprise_manager_for_mysql_database:13.2:*:*:*:*:*:*:*
Matching versions
Oracle » Micros Lucas » Version: 2.9.5
cpe:2.3:a:oracle:micros_lucas:2.9.5:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Online Mediation Controller » Version: 6.1
cpe:2.3:a:oracle:communications_online_mediation_controller:6.1:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Clearance Optimization Engine » Version: 14.0.5
cpe:2.3:a:oracle:retail_clearance_optimization_engine:14.0.5:*:*:*:*:*:*:*
Matching versions
Oracle » Utilities Network Management System » Version: 1.12.0.3
cpe:2.3:a:oracle:utilities_network_management_system:1.12.0.3:*:*:*:*:*:*:*
Matching versions
Oracle » Agile Plm » Version: 9.3.5
cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*
Matching versions
Oracle » Agile Plm » Version: 9.3.6
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Matching versions
Oracle » Agile Plm » Version: 9.3.4
cpe:2.3:a:oracle:agile_plm:9.3.4:*:*:*:*:*:*:*
Matching versions
Oracle » Agile Plm » Version: 9.3.3
cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Financial Integration » Version: 15.0
cpe:2.3:a:oracle:retail_financial_integration:15.0:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Financial Integration » Version: 16.0
cpe:2.3:a:oracle:retail_financial_integration:16.0:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Financial Integration » Version: 13.2
cpe:2.3:a:oracle:retail_financial_integration:13.2:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Financial Integration » Version: 14.1
cpe:2.3:a:oracle:retail_financial_integration:14.1:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Financial Integration » Version: 14.0
cpe:2.3:a:oracle:retail_financial_integration:14.0:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Services Gatekeeper
Versions before (<) 6.1.0.4.0
cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Performance Intelligence Center
Versions before (<) 10.2.1
cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Network Integrity
Versions from including (>=) 7.3.2 and up to, including, (<=) 7.3.6
cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Advanced Inventory Planning » Version: 15.0
cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Markdown Optimization » Version: 13.4.4
cpe:2.3:a:oracle:retail_markdown_optimization:13.4.4:*:*:*:*:*:*:*
Matching versions
Vmware » Spring Framework
Versions before (<) 4.3.18
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
Matching versions
Vmware » Spring Framework
Versions from including (>=) 5.0.0 and before (<) 5.0.7
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-11039

EPSS FAQ

2.92%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 86 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-11039

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2018-11039

https://www.oracle.com/security-alerts/cpujan2020.html

Oracle Critical Patch Update Advisory - January 2020
Patch;Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

CPU Oct 2018
Patch;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpujul2020.html

Oracle Critical Patch Update Advisory - July 2020
Patch;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Oracle Critical Patch Update - July 2019
Patch;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Oracle Critical Patch Update - April 2019
Patch;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Oracle Critical Patch Update - January 2019
Patch;Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html

[SECURITY] [DLA 2635-1] libspring-java security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpuoct2021.html

Oracle Critical Patch Update Advisory - October 2021
Patch;Third Party Advisory

CVEs referencing this url
https://pivotal.io/security/cve-2018-11039

CVE-2018-11039: Cross Site Tracing (XST) with Spring Framework | Security | Pivotal
Mitigation;Vendor Advisory
http://www.securityfocus.com/bid/107984

Spring Framework CVE-2018-11039 Cross Site Scripting Vulnerability
Broken Link;Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2018-11039

Products affected by CVE-2018-11039

Exploit prediction scoring system (EPSS) score for CVE-2018-11039

CVSS scores for CVE-2018-11039

References for CVE-2018-11039