CVEvulnerability

CVE-2018-11040

7.5 HIGH Published 2018-06-25 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2018-06-25
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-829

Description

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

Affected configurations

• vmware spring framework (< 4.3.18) • vmware spring framework (>= 5.0.0 < 5.0.7) • oracle agile product lifecycle management 9.3.3 • oracle agile product lifecycle management 9.3.4 • oracle agile product lifecycle management 9.3.5 • oracle application testing suite 12.5.0.3 • oracle application testing suite 13.1.0.1 • oracle application testing suite 13.2.0.1 • oracle application testing suite 13.3.0.1 • oracle communications network integrity (>= 7.3.2 <= 7.3.6) • oracle communications online mediation controller 6.1 • oracle communications services gatekeeper (< 6.1.0.4.0) • oracle communications unified inventory management 7.3.2 • oracle communications unified inventory management 7.3.4 • oracle communications unified inventory management 7.3.5 • oracle communications unified inventory management 7.4.0 • oracle endeca information discovery integrator 3.1.0 • oracle endeca information discovery integrator 3.2.0 • oracle enterprise manager 13.2 • oracle enterprise manager ops center 12.3.3 • oracle flexcube private banking 2.0.0.0 • oracle flexcube private banking 2.2.0.1 • oracle flexcube private banking 12.0.1.0 • oracle flexcube private banking 12.0.3.0 • oracle flexcube private banking 12.1.0.0 • oracle healthcare master person index 3.0 • oracle healthcare master person index 4.0 • oracle hospitality guest access 4.2.0 • oracle hospitality guest access 4.2.1 • oracle insurance calculation engine (>= 11.0.0 <= 11.3.1) • oracle insurance rules palette 10.0 • oracle insurance rules palette 10.2 • oracle micros lucas 2.9.5 • oracle mysql enterprise monitor (<= 3.4.9.4237) • oracle mysql enterprise monitor (>= 3.4.10 <= 4.0.6.5281) • oracle mysql enterprise monitor (>= 4.0.7 <= 8.0.2.8191) • oracle product lifecycle management 9.3.6 • oracle retail advanced inventory planning 15.0 • oracle retail clearance optimization engine 14.0.5 • oracle retail customer insights 15.0 • oracle retail customer insights 16.0 • oracle retail markdown optimization 13.4.4 • oracle retail predictive application server 14.0.3.26 • oracle retail predictive application server 14.1.3.37 • oracle retail predictive application server 15.0.3.100 • oracle retail predictive application server 16.0 • oracle retail service backbone 16.0.1 • oracle retail xstore point of service 7.1 • oracle utilities network management system 1.12.0.3 • oracle weblogic server 12.2.1.3.0 • debian debian linux 9.0

Related

Weakness · CWE (1)

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References