{"id":"CVE-2018-11039","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-11039","generatedAt":"2026-10-28T21:29:51.498Z","title":"Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC.","description":"Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.","published":"2018-06-25T15:29:00.000Z","lastModified":"2026-10-08T22:16:44.000Z","status":"Modified","sourceIdentifier":"security_alert@emc.com","cvss":{"version":"3.1","score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cwe":[],"affected":["vmware/spring framework","oracle/agile product lifecycle management","oracle/application testing suite","oracle/communications diameter signaling router","oracle/communications network integrity","oracle/communications online mediation controller","oracle/communications performance intelligence center","oracle/communications services gatekeeper","oracle/communications unified inventory management","oracle/endeca information discovery integrator","oracle/enterprise manager base platform","oracle/enterprise manager for mysql database","oracle/enterprise manager ops center","oracle/health sciences information manager","oracle/healthcare master person index","oracle/hospitality guest access","oracle/insurance calculation engine","oracle/insurance rules palette","oracle/micros lucas","oracle/mysql enterprise monitor","oracle/primavera p6 enterprise project portfolio management","oracle/retail advanced inventory planning","oracle/retail assortment planning","oracle/retail clearance optimization engine","oracle/retail customer insights","oracle/retail financial integration","oracle/retail integration bus","oracle/retail markdown optimization","oracle/retail predictive application server","oracle/retail xstore point of service","oracle/utilities network management system","oracle/weblogic server","debian/debian linux"],"epss":{"score":0.02769,"percentile":0.86244,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (2.77%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"http://www.securityfocus.com/bid/107984","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"security_alert@emc.com"},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html","tags":["Mailing List","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://pivotal.io/security/cve-2018-11039","tags":["Mitigation","Vendor Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/107984","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://pivotal.io/security/cve-2018-11039","tags":["Mitigation","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-11039","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}