CVE-2018-11039

01/תיאור (מקור, אנגלית)

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

02/מוצרים מושפעים

vmware: spring framework; oracle: agile product lifecycle management; oracle: application testing suite; oracle: communications diameter signaling router; oracle: communications network integrity; oracle: communications online mediation controller; oracle: communications performance intelligence center; oracle: communications services gatekeeper; oracle: communications unified inventory management; oracle: endeca information discovery integrator; oracle: enterprise manager base platform; oracle: enterprise manager for mysql database; oracle: enterprise manager ops center; oracle: health sciences information manager; oracle: healthcare master person index

03/קישורים10

• pivotal.io/security/cve-2018-11039 MitigationVendor Advisory
• pivotal.io/security/cve-2018-11039 MitigationVendor Advisory
• www.oracle.com/technetwork/security-advisory/cpuoct2018-442829‮… PatchThird Party Advisory
• www.oracle.com/security-alerts/cpujan2020.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpujul2020.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• www.oracle.com/technetwork/security-advisory/cpuapr2019-507281‮… PatchThird Party Advisory
• www.oracle.com/technetwork/security-advisory/cpujan2019-507280‮… PatchThird Party Advisory
• www.oracle.com/technetwork/security-advisory/cpujul2019-507283‮… PatchThird Party Advisory
• www.oracle.com/technetwork/security-advisory/cpuoct2018-442829‮… PatchThird Party Advisory