CVE-2018-11039 Spring Framework
| Affected software | Spring Framework |
|---|---|
| Severity | 5.9 Medium CVSS 3.1 2 scores |
| Fixed in | 5.0.7, 4.3.18 |
| Published | 25 Jun 2018 |
| Updated | 8 Oct 2026 |
Description
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 8 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 2.8% chance in 30 days
Waratek protection
Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.
VRT has not found a public code change for this CVE yet.
- Protection none
- Action not pursued
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to No source fix or exploit. |
CVSS
5.9 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
CVSS
5.9 MEDIUM v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary | published |
| CVSS 2.0 | 4.3 | none | AV:N/AC:M/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2018 ↗ | CPU | 2018-Q4 | Oracle Construction and Engineering Suite / Web Access (Spring Framework) (18.8) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Construction and Engineering Suite | Web Access (Spring Framework) | 18.8 | 18.8 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.springframework:spring-web |
5.0.0 | 5.0.7 |
unbounded |
org.springframework:spring-web |
4.3.0 | 4.3.18 |
unbounded |
Products and versions
34 products, 66 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | debian | debian linux | generic | 9.0 |
| nvd | oracle | agile product lifecycle management | generic | 9.3.3 · 9.3.4 · 9.3.5 · 9.3.6 |
| nvd | oracle | application testing suite | generic | 12.5.0.3 · 13.1.0.1 · 13.2.0.1 · 13.3.0.1 |
| nvd | oracle | communications diameter signaling router | generic | ＜ 8.3 |
| nvd | oracle | communications network integrity | generic | ≥ 7.3.2 and ≤ 7.3.6 |
| nvd | oracle | communications online mediation controller | generic | 6.1 |
| nvd | oracle | communications performance intelligence center | generic | ＜ 10.2.1 |
| nvd | oracle | communications services gatekeeper | generic | ＜ 6.1.0.4.0 |
| nvd | oracle | communications unified inventory management | generic | 7.3.2 · 7.3.4 · 7.3.5 · 7.4.0 |
| nvd | oracle | endeca information discovery integrator | generic | 3.1.0 · 3.2.0 |
| nvd | oracle | enterprise manager base platform | generic | 12.1.0.5.0 · 13.2.0.0.0 · 13.3.0.0.0 |
| nvd | oracle | enterprise manager for mysql database | generic | 13.2 |
| nvd | oracle | enterprise manager ops center | generic | 12.3.3 |
| nvd | oracle | health sciences information manager | generic | 3.0 |
| nvd | oracle | healthcare master person index | generic | 3.0 · 4.0 |
| nvd | oracle | hospitality guest access | generic | 4.2.0 · 4.2.1 |
| nvd | oracle | insurance calculation engine | generic | 10.2 · ≥ 11.0.0 and ≤ 11.3.1 |
| nvd | oracle | insurance rules palette | generic | 10.0 · 10.2 |
| nvd | oracle | micros lucas | generic | 2.9.5 |
| nvd | oracle | mysql enterprise monitor | generic | ≤ 3.4.9.4237 · ≥ 4.0.0 and ≤ 4.0.6.5281 · ≥ 8.0.0 and ≤ 8.0.2.8191 |
| nvd | oracle | primavera p6 enterprise project portfolio management | generic | 18.8 |
| nvd | oracle | retail advanced inventory planning | generic | 15.0 |
| nvd | oracle | retail assortment planning | generic | 14.1 · 15.0 · 16.0 |
| nvd | oracle | retail clearance optimization engine | generic | 14.0.5 |
| nvd | oracle | retail customer insights | generic | 15.0 · 16.0 |
| nvd | oracle | retail financial integration | generic | 13.2 · 14.0 · 14.1 · 15.0 · 16.0 |
| nvd | oracle | retail integration bus | generic | 14.1.2 |
| nvd | oracle | retail markdown optimization | generic | 13.4.4 |
| nvd | oracle | retail predictive application server | generic | 14.0.3.26 · 14.1.3.37 · 15.0.3..100 · 16.0 |
| nvd | oracle | retail xstore point of service | generic | 7.1 |
| nvd | oracle | utilities network management system | generic | 1.12.0.3 |
| nvd | oracle | weblogic server | generic | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 |
| osv | org.springframework | spring-web | generic | ≥ 4.3.0 and ＜ 4.3.18 · ≥ 5.0.0 and ＜ 5.0.7 |
| nvd | vmware | spring framework | generic | ＜ 4.3.18 · ≥ 5.0.0 and ＜ 5.0.7 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, WEB ACCESS (SPRING FRAMEWORK), NO AUTH REMOTE EXPLOIT **Products:** PRIMAVERA P6 ENTERPRISE PROJECT PORTFOLIO MANAGEMENT, ORACLE CONSTRUCTION AND ENGINEERING SUITE, SPRINGFRAMEWORK
References
Timeline
Timeline
| Published | 2018-06-25 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |