Vulnerability Intelligence

CVE-2018-11039

Medium 5.9

Published
Last modified
NVD status
Modified

Description

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

Affected products

vmware: spring framework; oracle: agile product lifecycle management; oracle: application testing suite; oracle: communications diameter signaling router; oracle: communications network integrity; oracle: communications online mediation controller; oracle: communications performance intelligence center; oracle: communications services gatekeeper; oracle: communications unified inventory management; oracle: endeca information discovery integrator; oracle: enterprise manager base platform; oracle: enterprise manager for mysql database; oracle: enterprise manager ops center; oracle: health sciences information manager; oracle: healthcare master person index

References10

Metrics

CVSS 3.1
5.9 MEDIUM Score source: NVD CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS — exploit probability
3% percentile: 86 · as of 3 November 2026

Could this be exploited in your environment?

A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.

Request a pentest