CVE-2018-11039
—CVSS 3.1
5.9 medium
EPSS
3%p85
Published
()
Modified
Description
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
- Vendors
- vmwareoracledebian
- Products
- spring framework, agile product lifecycle management, application testing suite, communications diameter signaling router, communications network integrity, communications online mediation controller, communications performance intelligence center, communications services gatekeeper, communications unified inventory management, endeca information discovery integrator, enterprise manager base platform, enterprise manager for mysql database
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
In the news0 stories
No ingested article mentions this CVE yet.