CVE-2018-11040 Moderate severity vulnerability that affects org.springframework:spring-core
HighCVSS 7.5
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-core(Maven) | >= 5.0.0.RELEASE, < 5.0.7.RELEASE | 5.0.7.RELEASE |
| org.springframework/spring-core(Maven) | = 5.0.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | >= 4.3.0.RELEASE, < 4.3.18.RELEASE | 4.3.18.RELEASE |
| org.springframework/spring-core(Maven) | = 4.3.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.10.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.11.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.12.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.13.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.14.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.15.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.16.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.17.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.7.RELEASE | No fix listed |
Show 58 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-core(Maven) | = 4.3.8.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.9.RELEASE | No fix listed |
| debian/libspring-java(Debian:12) | < 4.3.19-1 | 4.3.19-1 |
| debian/libspring-java(Debian:13) | < 4.3.19-1 | 4.3.19-1 |
| debian/libspring-java(Debian:14) | < 4.3.19-1 | 4.3.19-1 |
| pivotal Spring Framework | >= 5.0.x, < 5.0.7 | 5.0.7 |
| pivotal Spring Framework | >= 4.3.x, < 4.3.18 | 4.3.18 |
| VMware spring framework | < 4.3.18 | 4.3.18 |
| VMware spring framework | >= 5.0.0, < 5.0.7 | 5.0.7 |
| oracle agile product lifecycle management | = 9.3.3 | No fix listed |
| oracle agile product lifecycle management | = 9.3.4 | No fix listed |
| oracle agile product lifecycle management | = 9.3.5 | No fix listed |
| oracle application testing suite | = 12.5.0.3 | No fix listed |
| oracle application testing suite | = 13.1.0.1 | No fix listed |
| oracle application testing suite | = 13.2.0.1 | No fix listed |
| oracle application testing suite | = 13.3.0.1 | No fix listed |
| oracle communications network integrity | >= 7.3.2, <= 7.3.6 | No fix listed |
| oracle communications online mediation controller | = 6.1 | No fix listed |
| oracle communications services gatekeeper | < 6.1.0.4.0 | 6.1.0.4.0 |
| oracle communications unified inventory management | = 7.3.2 | No fix listed |
| oracle communications unified inventory management | = 7.3.4 | No fix listed |
| oracle communications unified inventory management | = 7.3.5 | No fix listed |
| oracle communications unified inventory management | = 7.4.0 | No fix listed |
| oracle endeca information discovery integrator | = 3.1.0 | No fix listed |
| oracle endeca information discovery integrator | = 3.2.0 | No fix listed |
| oracle enterprise manager | = 13.2 | No fix listed |
| oracle enterprise manager ops center | = 12.3.3 | No fix listed |
| oracle flexcube private banking | = 2.0.0.0 | No fix listed |
| oracle flexcube private banking | = 2.2.0.1 | No fix listed |
| oracle flexcube private banking | = 12.0.1.0 | No fix listed |
| oracle flexcube private banking | = 12.0.3.0 | No fix listed |
| oracle flexcube private banking | = 12.1.0.0 | No fix listed |
| oracle healthcare master person index | = 3.0 | No fix listed |
| oracle healthcare master person index | = 4.0 | No fix listed |
| oracle hospitality guest access | = 4.2.0 | No fix listed |
| oracle hospitality guest access | = 4.2.1 | No fix listed |
| oracle insurance calculation engine | >= 11.0.0, <= 11.3.1 | No fix listed |
| oracle insurance rules palette | = 10.0 | No fix listed |
| oracle insurance rules palette | = 10.2 | No fix listed |
| oracle micros lucas | = 2.9.5 | No fix listed |
| oracle mysql enterprise monitor | <= 3.4.9.4237 | No fix listed |
| oracle mysql enterprise monitor | >= 3.4.10, <= 4.0.6.5281 | No fix listed |
| oracle mysql enterprise monitor | >= 4.0.7, <= 8.0.2.8191 | No fix listed |
| oracle product lifecycle management | = 9.3.6 | No fix listed |
| oracle retail advanced inventory planning | = 15.0 | No fix listed |
| oracle retail clearance optimization engine | = 14.0.5 | No fix listed |
| oracle retail customer insights | = 15.0 | No fix listed |
| oracle retail customer insights | = 16.0 | No fix listed |
| oracle retail markdown optimization | = 13.4.4 | No fix listed |
| oracle retail predictive application server | = 14.0.3.26 | No fix listed |
| oracle retail predictive application server | = 14.1.3.37 | No fix listed |
| oracle retail predictive application server | = 15.0.3.100 | No fix listed |
| oracle retail predictive application server | = 16.0 | No fix listed |
| oracle retail service backbone | = 16.0.1 | No fix listed |
| oracle retail xstore point of service | = 7.1 | No fix listed |
| oracle utilities network management system | = 1.12.0.3 | No fix listed |
| oracle weblogic server | = 12.2.1.3.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com vendor-advisory
- github.com product
- [debian-lts-announce] 20210423 [SECURITY] [DLA 2635-1] libspring-java security update mailing-list third-party-advisory
- pivotal.io mitigation vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- Debian Security Tracker CVE-2018-11040 vendor-advisory