Cross Site Tracing Vulnerability in Spring Framework by Pivotal
CVE-2018-11039

5.9MEDIUM

Key Information:

Vendor

Pivotal

Status
Spring Framework
Vendor
CVE Published:
25 June 2018

What is CVE-2018-11039?

The Spring Framework has a vulnerability that enables web applications to alter the HTTP request method to any specified method, including TRACE. This is facilitated by the HiddenHttpMethodFilter within Spring MVC. If an application contains an existing Cross-Site Scripting (XSS) vulnerability, an attacker could leverage this flaw to execute Cross Site Tracing (XST) attacks, which may compromise sensitive data and escalate threats to the web application.

Affected Version(s)

Spring Framework 5.0.x < 5.0.7

Spring Framework 4.3.x < 4.3.18

References

http://www.securityfocus.com/bid/107984
vdb-entryx_refsource_BID
http://www.oracle.com/technetwork/security-advisory/cpuoc...
x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpujul2020.html
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.