CVE-2018-11039

Published: Jun 25, 2018Modified: Nov 21, 2024

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

Vulnerable Software	Affected Versions
Vmware Spring Framework	Before 4.3.18
Vmware Spring Framework	From 5.0.0 to 5.0.7

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.3
Oracle Agile Plm	Version 9.3.4
Oracle Agile Plm	Version 9.3.5
Oracle Agile Plm	Version 9.3.6
Oracle Application Testing Suite	Version 12.5.0.3
Oracle Application Testing Suite	Version 13.1.0.1
Oracle Application Testing Suite	Version 13.2.0.1
Oracle Application Testing Suite	Version 13.3.0.1
Oracle Communications Diameter Signaling Router	Before 8.3
Oracle Communications Network Integrity	From 7.3.2 to 7.3.6
Oracle Communications Online Mediation Controller	Version 6.1
Oracle Communications Performance Intelligence Center	Before 10.2.1
Oracle Communications Services Gatekeeper	Before 6.1.0.4.0
Oracle Communications Unified Inventory Management	Version 7.3.2
Oracle Communications Unified Inventory Management	Version 7.3.4
Oracle Communications Unified Inventory Management	Version 7.3.5
Oracle Communications Unified Inventory Management	Version 7.4.0
Oracle Endeca Information Discovery Integrator	Version 3.1.0
Oracle Endeca Information Discovery Integrator	Version 3.2.0
Oracle Enterprise Manager Base Platform	Version 12.1.0.5.0
Oracle Enterprise Manager Base Platform	Version 13.2.0.0.0
Oracle Enterprise Manager Base Platform	Version 13.3.0.0.0
Oracle Enterprise Manager For Mysql Database	Version 13.2
Oracle Enterprise Manager Ops Center	Version 12.3.3
Oracle Health Sciences Information Manager	Version 3.0
Oracle Healthcare Master Person Index	Version 3.0
Oracle Healthcare Master Person Index	Version 4.0
Oracle Hospitality Guest Access	Version 4.2.0
Oracle Hospitality Guest Access	Version 4.2.1
Oracle Insurance Calculation Engine	From 11.0.0 to 11.3.1
Oracle Insurance Calculation Engine	Version 10.2
Oracle Insurance Rules Palette	Version 10.0
Oracle Insurance Rules Palette	Version 10.2
Oracle Micros Lucas	Version 2.9.5
Oracle Mysql Enterprise Monitor	Up to 3.4.9.4237
Oracle Mysql Enterprise Monitor	From 4.0.0 to 4.0.6.5281
Oracle Mysql Enterprise Monitor	From 8.0.0 to 8.0.2.8191
Oracle Primavera P6 Enterprise Project Portfolio Management	Version 18.8
Oracle Retail Advanced Inventory Planning	Version 15.0
Oracle Retail Assortment Planning	Version 14.1
Oracle Retail Assortment Planning	Version 15.0
Oracle Retail Assortment Planning	Version 16.0
Oracle Retail Clearance Optimization Engine	Version 14.0.5
Oracle Retail Customer Insights	Version 15.0
Oracle Retail Customer Insights	Version 16.0
Oracle Retail Financial Integration	Version 13.2
Oracle Retail Financial Integration	Version 14.0
Oracle Retail Financial Integration	Version 14.1
Oracle Retail Financial Integration	Version 15.0
Oracle Retail Financial Integration	Version 16.0
Oracle Retail Integration Bus	Version 14.1.2
Oracle Retail Markdown Optimization	Version 13.4.4
Oracle Retail Predictive Application Server	Version 14.0.3.26
Oracle Retail Predictive Application Server	Version 14.1.3.37
Oracle Retail Predictive Application Server	Version 15.0.3..100
Oracle Retail Predictive Application Server	Version 16.0
Oracle Retail Xstore Point Of Service	Version 7.1
Oracle Utilities Network Management System	Version 1.12.0.3
Oracle Weblogic Server	Version 10.3.6.0.0
Oracle Weblogic Server	Version 12.1.3.0.0
Oracle Weblogic Server	Version 12.2.1.3.0

CVE-2018-11039

Description

Affected (64)

References (20)

Timeline