High severity · published Jun 25, 2018
CVE-2018-11040
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON…
7.5
CVSS
3.2%
EPSS
No
On KEV
Description
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WebLogic Server · Oracle
12.2.1.3.0 · source: NVD
SF
Spring Framework · Pivotal
5.0.x before 5.0.7; 4.3.x before 4.3.18 · source: vendor, NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.3; 9.3.4; 9.3.5 · source: NVD
AT
Application Testing Suite · Oracle
12.5.0.3; 13.1.0.1; 13.2.0.1; 13.3.0.1 · source: NVD
CN
Communications Network Integrity · Oracle
7.3.2 through 7.3.6 · source: NVD
CO
Communications Online Mediation Controller · Oracle
6.1 · source: NVD
CS
Communications Services Gatekeeper · Oracle
before 6.1.0.4.0 · source: NVD
CU
Communications Unified Inventory Management · Oracle
7.3.2; 7.3.4; 7.3.5; 7.4.0 · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
EI
Endeca Information Discovery Integrator · Oracle
3.1.0; 3.2.0 · source: NVD
EM
Enterprise Manager · Oracle
13.2 · source: NVD
EM
Enterprise Manager Ops Center · Oracle
12.3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11040
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11040
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Mailing List
https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
Mitigation
https://pivotal.io/security/cve-2018-11040
Patch
https://www.oracle.com/security-alerts/cpujan2020.html
Patch
https://www.oracle.com/security-alerts/cpujul2020.html
Patch
https://www.oracle.com/security-alerts/cpuoct2021.html
More from WebLogic Server
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability
