VulnerabilityModified

CVE-2018-11040

HIGH 7.5EPSS 3.24%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 3.24% probability · 88th percentile
CISA KEV: Not listed
Weakness: CWE-829
Affected: vmware/spring framework · oracle/agile product lifecycle management · oracle/application testing suite · oracle/communications network integrity · oracle/communications online mediation controller · oracle/communications services gatekeeper · oracle/communications unified inventory management · oracle/endeca information discovery integrator · oracle/enterprise manager · oracle/enterprise manager ops center · oracle/flexcube private banking · oracle/healthcare master person index · oracle/hospitality guest access · oracle/insurance calculation engine · oracle/insurance rules palette · oracle/micros lucas · oracle/mysql enterprise monitor · oracle/product lifecycle management · oracle/retail advanced inventory planning · oracle/retail clearance optimization engine · +8 more
Source: security_alert@emc.com

References

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00022.htmlMailing List, Third Party Advisory
https://pivotal.io/security/cve-2018-11040Mitigation, Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlPatch, Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00022.htmlMailing List, Third Party Advisory
https://pivotal.io/security/cve-2018-11040Mitigation, Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlPatch, Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlPatch, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.