NetSight
IP …
medium5.9

CVE-2018-11039

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP requ…

Impact

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

Affected products

VendorProductAffected versions
VmwareSpring Framework
before 4.3.18
from 5.0.0 before 5.0.7
OracleAgile Product Lifecycle Management
Versions 9.3.3, 9.3.4, 9.3.5, 9.3.6
OracleApplication Testing Suite
Versions 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1
OracleCommunications Diameter Signaling Router
before 8.3
OracleCommunications Network Integrity
from 7.3.2 through 7.3.6
OracleCommunications Online Mediation Controller
Version 6.1
OracleCommunications Performance Intelligence Center
before 10.2.1
OracleCommunications Services Gatekeeper
before 6.1.0.4.0
OracleCommunications Unified Inventory Management
Versions 7.3.2, 7.3.4, 7.3.5, 7.4.0
OracleEndeca Information Discovery Integrator
Versions 3.1.0, 3.2.0
OracleEnterprise Manager Base Platform
Versions 12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0
OracleEnterprise Manager For Mysql Database
Version 13.2

References