CVE-2018-11039
Spring Framework Cross Site Tracing (XST)
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
- Record
CVE-2018-11039- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
- Record
CVE-2018-11039- Updated
- 2026-11-02
EUVDEUVD-2018-0561 No score
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
- Record
EUVD-2018-0561- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9gcm-f4x3-8jpw
Spring Framework Cross Site Tracing (XST)
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
- Record
GHSA-9gcm-f4x3-8jpw- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
- Record
CVE-2018-11039- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-11039
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
- Record
DEBIAN-CVE-2018-11039- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 12 moreShow less
OSVGHSA-9gcm-f4x3-8jpw
Spring Framework Cross Site Tracing (XST)
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
- Record
GHSA-9gcm-f4x3-8jpw- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-11039
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
- Record
UBUNTU-CVE-2018-11039- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2025-1760313981 No score
TuxCare security update for org.springframework (25 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 25 CVEs. Fixed in 4.0.0.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313981- Updated
- 2026-11-02
OSVCLSA-2025-1760313986 No score
TuxCare security update for org.springframework (29 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313986- Updated
- 2026-11-02
OSVCLSA-2026-1774311642 No score
TuxCare security update for org.springframework (8 CVEs)
TuxCare rebuilt 3 org.springframework packages to address 8 CVEs. Fixed in 4.1.7.RELEASE-tuxcare.2.
- Record
CLSA-2026-1774311642- Updated
- 2026-11-02
OSVCLSA-2026-1779238042 No score
TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 3 CVEs. Fixed in 3.0.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1779238042- Updated
- 2026-11-02
OSVCLSA-2026-1785380133 No score
TuxCare security update for org.springframework (5 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 5 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785380133- Updated
- 2026-11-02
OSVCLSA-2026-1785380498 No score
TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 6 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785380498- Updated
- 2026-11-02
OSVCLSA-2026-1785814744 No score
TuxCare security update for org.springframework (9 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 9 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785814744- Updated
- 2026-11-02
OSVCLSA-2026-1791107509 No score
TuxCare security update for org.springframework (35 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 35 CVEs. Fixed in 5.0.0.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791107509- Updated
- 2026-11-02
OSVCLSA-2026-1791289094 No score
TuxCare security update for org.springframework (31 CVEs)
TuxCare rebuilt 9 org.springframework packages to address 31 CVEs. Fixed in 4.3.16.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791289094- Updated
- 2026-11-02
OSVCLSA-2026-1791463819 No score
TuxCare security update for org.springframework (35 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 35 CVEs. Fixed in 4.3.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791463819- Updated
- 2026-11-02
Affected products
- pivotal spring framework
- vmware spring framework
- debian linux
- oracle agile product lifecycle management
- oracle application testing suite
- oracle communications diameter signaling router
- oracle communications network integrity
- oracle communications online mediation controller
- oracle communications performance intelligence center
- oracle communications services gatekeeper
- oracle communications unified inventory management
- oracle endeca information discovery integrator
Show 22 moreShow less
- oracle enterprise manager base platform
- oracle enterprise manager for mysql database
- oracle enterprise manager ops center
- oracle health sciences information manager
- oracle healthcare master person index
- oracle hospitality guest access
- oracle insurance calculation engine
- oracle insurance rules palette
- oracle micros lucas
- oracle mysql enterprise monitor
- oracle primavera p6 enterprise project portfolio management
- oracle retail advanced inventory planning
- oracle retail assortment planning
- oracle retail clearance optimization engine
- oracle retail customer insights
- oracle retail financial integration
- oracle retail integration bus
- oracle retail markdown optimization
- oracle retail predictive application server
- oracle retail xstore point of service
- oracle utilities network management system
- oracle weblogic server
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webMaven |
5.0.0 up to 5.0.7 | 5.0.7 |
org.springframework:spring-webMaven |
4.3.0 up to 4.3.18 | 4.3.18 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
Show 64 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-coreTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-oxmTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 8 CVEs |
4.1.7.RELEASE up to 4.1.7.RELEASE-tuxcare.2, plus listed versions 4.1.7.RELEASE-tuxcare.1 |
4.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 8 CVEs |
4.1.7.RELEASE up to 4.1.7.RELEASE-tuxcare.2, plus listed versions 4.1.7.RELEASE-tuxcare.1 |
4.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 8 CVEs |
4.1.7.RELEASE up to 4.1.7.RELEASE-tuxcare.2, plus listed versions 4.1.7.RELEASE-tuxcare.1 |
4.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 3 CVEs |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.1 | 3.0.5.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 3 CVEs |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.1 | 3.0.5.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 5 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.2, plus listed versions 4.3.4.RELEASE-tuxcare.1 |
4.3.4.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 5 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.2, plus listed versions 4.3.4.RELEASE-tuxcare.1 |
4.3.4.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 5 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.2, plus listed versions 4.3.4.RELEASE-tuxcare.1 |
4.3.4.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 5 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.2, plus listed versions 4.3.4.RELEASE-tuxcare.1 |
4.3.4.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 5 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.2, plus listed versions 4.3.4.RELEASE-tuxcare.1 |
4.3.4.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
libspring-javaDebian:12 |
before 4.3.19-1 | 4.3.19-1 |
libspring-javaDebian:13 |
before 4.3.19-1 | 4.3.19-1 |
libspring-javaDebian:14 |
before 4.3.19-1 | 4.3.19-1 |
libspring-javaDebian:9 From an advisory covering 4 CVEs |
before 4.3.5-1+deb9u1, plus listed versions 4.3.5-1 |
4.3.5-1+deb9u1 |
org.springframework:spring-webMaven |
5.0.0 up to 5.0.7, plus listed versions 5.0.0.RELEASE5.0.1.RELEASE5.0.2.RELEASE5.0.3.RELEASE5.0.4.RELEASE5.0.5.RELEASE5.0.6.RELEASE |
5.0.7 |
org.springframework:spring-webMaven |
4.3.0 up to 4.3.18, plus listed versions 4.3.0.RELEASE4.3.1.RELEASE4.3.10.RELEASE4.3.11.RELEASE4.3.12.RELEASE Show 13 moreShow less4.3.13.RELEASE4.3.14.RELEASE4.3.15.RELEASE4.3.16.RELEASE4.3.17.RELEASE4.3.2.RELEASE4.3.3.RELEASE4.3.4.RELEASE4.3.5.RELEASE4.3.6.RELEASE4.3.7.RELEASE4.3.8.RELEASE4.3.9.RELEASE |
4.3.18 |
libspring-javaUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.0.6.RELEASE-73.0.6.RELEASE-83.0.6.RELEASE-93.0.6.RELEASE-103.0.6.RELEASE-11 Show 4 moreShow less3.0.6.RELEASE-123.0.6.RELEASE-133.0.6.RELEASE-13ubuntu0.1~esm13.0.6.RELEASE-13ubuntu0.1~esm2 |
None known |
libspring-javaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.2.13-33.2.13-43.2.13-53.2.13-5ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11039 is a medium vulnerability (CVSS 5.9) in Pivotal Spring Framework, published June 25, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.77%, the 86th percentile. Fixed in org.springframework:spring-web 5.0.7.
References
securityfocus.com/bid/107984
oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Show 17 moreShow less
pivotal.io/security/cve-2018-11039
lists.debian.org/debian-lts-announce/2021/04/msg00022.html
nvd.nist.gov/vuln/detail/CVE-2018-11039
github.com/advisories/GHSA-9gcm-f4x3-8jpw
spring.io/security/cve-2018-11039
security-tracker.debian.org/tracker/CVE-2018-11039
ubuntu.com/security/CVE-2018-11039
cve.org/CVERecord?id=CVE-2018-11039