← לוח פגיעויות

CVE-2018-11039

בינונית 5.9

תיאור (מקור, אנגלית)

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

מדדים

CVSS 3.1
5.9 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS — סבירות ניצול
3% (אחוזון 100) נכון ל-16/9/2026

מוצרים מושפעים

vmware: spring framework; oracle: agile product lifecycle management; oracle: application testing suite; oracle: communications diameter signaling router; oracle: communications network integrity; oracle: communications online mediation controller; oracle: communications performance intelligence center; oracle: communications services gatekeeper; oracle: communications unified inventory management; oracle: endeca information discovery integrator; oracle: enterprise manager base platform; oracle: enterprise manager for mysql database; oracle: enterprise manager ops center; oracle: health sciences information manager; oracle: healthcare master person index

קישורים