CVE-2018-11040
Moderate severity vulnerability that affects org.springframework:spring-core
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
- Record
CVE-2018-11040- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-829
- Updated
- 2026-11-02
CVE List No score
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
- Record
CVE-2018-11040- Updated
- 2026-11-02
EUVDEUVD-2018-0587 No score
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
- Record
EUVD-2018-0587- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f26x-pr96-vw86
Moderate severity vulnerability that affects org.springframework:spring-core
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
- Record
GHSA-f26x-pr96-vw86- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-829
- Updated
- 2026-11-02
OSV
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
- Record
CVE-2018-11040- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-11040
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
- Record
DEBIAN-CVE-2018-11040- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-f26x-pr96-vw86
Moderate severity vulnerability that affects org.springframework:spring-core
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
- Record
GHSA-f26x-pr96-vw86- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-829
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-11040
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
- Record
UBUNTU-CVE-2018-11040- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1774311642 No score
TuxCare security update for org.springframework (8 CVEs)
TuxCare rebuilt 3 org.springframework packages to address 8 CVEs. Fixed in 4.1.7.RELEASE-tuxcare.2.
- Record
CLSA-2026-1774311642- Updated
- 2026-11-02
OSVCLSA-2026-1784769545 No score
TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 4 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.1.
- Record
CLSA-2026-1784769545- Updated
- 2026-11-02
OSVCLSA-2026-1784769546 No score
TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 3 org.springframework packages to address 3 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.1.
- Record
CLSA-2026-1784769546- Updated
- 2026-11-02
OSVCLSA-2026-1784769548 No score
TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 3 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1784769548- Updated
- 2026-11-02
OSVCLSA-2026-1791289094 No score
TuxCare security update for org.springframework (31 CVEs)
TuxCare rebuilt 9 org.springframework packages to address 31 CVEs. Fixed in 4.3.16.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791289094- Updated
- 2026-11-02
OSVCLSA-2026-1791463819 No score
TuxCare security update for org.springframework (35 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 35 CVEs. Fixed in 4.3.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791463819- Updated
- 2026-11-02
Affected products
- pivotal spring framework
- vmware spring framework
- debian linux
- oracle agile product lifecycle management
- oracle application testing suite
- oracle communications network integrity
- oracle communications online mediation controller
- oracle communications services gatekeeper
- oracle communications unified inventory management
- oracle endeca information discovery integrator
- oracle enterprise manager
- oracle enterprise manager ops center
Show 17 moreShow less
- oracle flexcube private banking
- oracle healthcare master person index
- oracle hospitality guest access
- oracle insurance calculation engine
- oracle insurance rules palette
- oracle micros lucas
- oracle mysql enterprise monitor
- oracle product lifecycle management
- oracle retail advanced inventory planning
- oracle retail clearance optimization engine
- oracle retail customer insights
- oracle retail markdown optimization
- oracle retail predictive application server
- oracle retail service backbone
- oracle retail xstore point of service
- oracle utilities network management system
- oracle weblogic server
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-coreMaven |
5.0.0.RELEASE up to 5.0.7.RELEASE | 5.0.7.RELEASE |
org.springframework:spring-coreMaven |
4.3.0.RELEASE up to 4.3.18.RELEASE | 4.3.18.RELEASE |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 8 CVEs |
4.1.7.RELEASE up to 4.1.7.RELEASE-tuxcare.2, plus listed versions 4.1.7.RELEASE-tuxcare.1 |
4.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 8 CVEs |
4.1.7.RELEASE up to 4.1.7.RELEASE-tuxcare.2, plus listed versions 4.1.7.RELEASE-tuxcare.1 |
4.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 8 CVEs |
4.1.7.RELEASE up to 4.1.7.RELEASE-tuxcare.2, plus listed versions 4.1.7.RELEASE-tuxcare.1 |
4.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 4 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.1 | 4.3.9.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 4 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.1 | 4.3.9.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 3 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.1 | 4.3.4.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 3 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.1 | 4.3.4.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 3 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.1 | 4.3.4.RELEASE-tuxcare.1 |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-coreTuxCare:Maven From an advisory covering 3 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.1 | 5.0.5.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 3 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.1 | 5.0.5.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 31 CVEs |
4.3.16.RELEASE up to 4.3.16.RELEASE-tuxcare.1 | 4.3.16.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
libspring-javaDebian:12 |
before 4.3.19-1 | 4.3.19-1 |
libspring-javaDebian:13 |
before 4.3.19-1 | 4.3.19-1 |
libspring-javaDebian:14 |
before 4.3.19-1 | 4.3.19-1 |
libspring-javaDebian:9 From an advisory covering 4 CVEs |
before 4.3.5-1+deb9u1, plus listed versions 4.3.5-1 |
4.3.5-1+deb9u1 |
org.springframework:spring-coreMaven |
5.0.0.RELEASE up to 5.0.7.RELEASE, plus listed versions 5.0.1.RELEASE5.0.2.RELEASE5.0.3.RELEASE5.0.4.RELEASE5.0.5.RELEASE5.0.6.RELEASE |
5.0.7.RELEASE |
org.springframework:spring-coreMaven |
4.3.0.RELEASE up to 4.3.18.RELEASE, plus listed versions 4.3.1.RELEASE4.3.10.RELEASE4.3.11.RELEASE4.3.12.RELEASE4.3.13.RELEASE Show 12 moreShow less4.3.14.RELEASE4.3.15.RELEASE4.3.16.RELEASE4.3.17.RELEASE4.3.2.RELEASE4.3.3.RELEASE4.3.4.RELEASE4.3.5.RELEASE4.3.6.RELEASE4.3.7.RELEASE4.3.8.RELEASE4.3.9.RELEASE |
4.3.18.RELEASE |
libspring-javaUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.0.6.RELEASE-73.0.6.RELEASE-83.0.6.RELEASE-93.0.6.RELEASE-103.0.6.RELEASE-11 Show 4 moreShow less3.0.6.RELEASE-123.0.6.RELEASE-133.0.6.RELEASE-13ubuntu0.1~esm13.0.6.RELEASE-13ubuntu0.1~esm2 |
None known |
libspring-javaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.2.13-33.2.13-43.2.13-53.2.13-5ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11040 is a high vulnerability (CVSS 7.5) in Pivotal Spring Framework, published June 25, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.18%, the 88th percentile. Fixed in org.springframework:spring-core 5.0.7.RELEASE.
References
oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Show 11 moreShow less
pivotal.io/security/cve-2018-11040
lists.debian.org/debian-lts-announce/2021/04/msg00022.html
nvd.nist.gov/vuln/detail/CVE-2018-11040
github.com/advisories/GHSA-f26x-pr96-vw86
security-tracker.debian.org/tracker/CVE-2018-11040
ubuntu.com/security/CVE-2018-11040
cve.org/CVERecord?id=CVE-2018-11040