Medium severity · published Jun 25, 2018
CVE-2018-11039
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any…
5.9
CVSS
2.8%
EPSS
No
On KEV
Description
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WebLogic Server · Oracle
10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0 · source: NVD
SF
Spring Framework · Pivotal
5.0.x before 5.0.7; 4.3.x before 4.3.18 · source: vendor, NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.3; 9.3.4; 9.3.5; 9.3.6 · source: NVD
AT
Application Testing Suite · Oracle
12.5.0.3; 13.1.0.1; 13.2.0.1; 13.3.0.1 · source: NVD
CD
Communications Diameter Signaling Router · Oracle
before 8.3 · source: NVD
CN
Communications Network Integrity · Oracle
7.3.2 through 7.3.6 · source: NVD
CO
Communications Online Mediation Controller · Oracle
6.1 · source: NVD
CP
Communications Performance Intelligence Center · Oracle
before 10.2.1 · source: NVD
CS
Communications Services Gatekeeper · Oracle
before 6.1.0.4.0 · source: NVD
CU
Communications Unified Inventory Management · Oracle
7.3.2; 7.3.4; 7.3.5; 7.4.0 · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
EI
Endeca Information Discovery Integrator · Oracle
3.1.0; 3.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11039
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11039
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Broken Link
http://www.securityfocus.com/bid/107984
Mailing List
https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
Mitigation
https://pivotal.io/security/cve-2018-11039
Patch
https://www.oracle.com/security-alerts/cpujan2020.html
Patch
https://www.oracle.com/security-alerts/cpujul2020.html
More from WebLogic Server
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability