VULNERABILITY INTELLIGENCE
CVE-2018-11039
CVSS score5.9 MEDIUM
EPSS probability2.75%
CISA KEVNot currently listed
Published2018-06-25
Last modified2026-10-08
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
Primary references
- security_alert@emc.com — Patch, Third Party Advisory
- security_alert@emc.com — Broken Link, Third Party Advisory, VDB Entry
- security_alert@emc.com — Mailing List, Third Party Advisory
- security_alert@emc.com — Mitigation, Vendor Advisory
- security_alert@emc.com — Patch, Third Party Advisory
- security_alert@emc.com — Patch, Third Party Advisory
- security_alert@emc.com — Patch, Third Party Advisory
- security_alert@emc.com — Patch, Third Party Advisory
- security_alert@emc.com — Patch, Third Party Advisory
- security_alert@emc.com — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory, VDB Entry