CVE-2018-11040

Опубликовано: 25 июн. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 4.3

EPSS Низкий

Описание

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

Ссылки

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
Mailing List
Third Party Advisory
https://pivotal.io/security/cve-2018-11040
Mitigation
Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Patch
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Patch
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Patch
Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
Mailing List
Third Party Advisory
https://pivotal.io/security/cve-2018-11040
Mitigation
Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Patch
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Patch
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*

Версия до 4.3.18 (исключая)

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*

Версия от 5.0.0 (включая) до 5.0.7 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*

Версия от 7.3.2 (включая) до 7.3.6 (включая)

cpe:2.3:a:oracle:communications_online_mediation_controller:6.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*

Версия до 6.1.0.4.0 (исключая)

cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager:13.2:*:*:*:*:mysql:*:*

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:2.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:2.2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:12.0.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:12.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_private_banking:12.1.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:healthcare_master_person_index:3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:healthcare_master_person_index:4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_calculation_engine:*:*:*:*:*:*:*:*

Версия от 11.0.0 (включая) до 11.3.1 (включая)

cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:micros_lucas:2.9.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*

Версия до 3.4.9.4237 (включая)

cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*

Версия от 3.4.10 (включая) до 4.0.6.5281 (включая)

cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*

Версия от 4.0.7 (включая) до 8.0.2.8191 (включая)

cpe:2.3:a:oracle:product_lifecycle_management:9.3.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_clearance_optimization_engine:14.0.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_markdown_optimization:13.4.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_predictive_application_server:14.0.3.26:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3.37:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3.100:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_predictive_application_server:16.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:16.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:utilities_network_management_system:1.12.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 92%

0.08246

Низкий

7.5 High

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-829

Связанные уязвимости

CVE-2018-11040

CVSS3: 7.5

ubuntu

почти 7 лет назад

CVE-2018-11040

CVSS3: 3.7

redhat

около 7 лет назад

CVE-2018-11040

CVSS3: 7.5

debian

почти 7 лет назад

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3 ...

GHSA-f26x-pr96-vw86

CVSS3: 5.9

github

больше 6 лет назад

Moderate severity vulnerability that affects org.springframework:spring-core

BDU:2019-01776

CVSS3: 5.9

fstec

около 7 лет назад

Уязвимость программной платформы Spring Framework, связанная с ошибками в настройках безопасности, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации

EPSS

Процентиль: 92%

0.08246

Низкий

7.5 High

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-829