What’s Vulnerable › Vulnerabilities

CVE-2018-11039

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-06-25 · updated 2026-10-08

Description

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

Affected products

• Debian Linux: 9.0
• Oracle Corporation Oracle Agile PLM: 9.3.3, 9.3.4, 9.3.5, 9.3.6
• Oracle Corporation Oracle Application Testing Suite: 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1
• Oracle Corporation Communications Diameter Signaling Router (DSR): before 8.3 — fixed in 8.3
• Oracle Communications Network Integrity: from 7.3.2 through 7.3.6
• Oracle Communications Online Mediation Controller: 6.1
• Oracle Communications Performance Intelligence Center: before 10.2.1 — fixed in 10.2.1
• Oracle Communications Services Gatekeeper: before 6.1.0.4.0 — fixed in 6.1.0.4.0
• Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.2, 7.3.4, 7.3.5, 7.4.0
• Oracle Corporation Endeca Information Discovery Integrator: 3.1.0, 3.2.0
• Oracle Corporation Enterprise Manager Base Platform: 12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0
• Oracle Enterprise Manager For Mysql Database: 13.2
• Oracle Corporation Enterprise Manager Ops Center: 12.3.3
• Oracle Health Sciences Information Manager: 3.0
• Oracle Healthcare Master Person Index: 3.0, 4.0
• Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
• Oracle Insurance Calculation Engine: from 11.0.0 through 11.3.1; 10.2
• Oracle Insurance Rules Palette: 10.0, 10.2
• Oracle Corporation MICROS Lucas: 2.9.5
• Oracle Corporation MySQL Enterprise Monitor: through 3.4.9.4237; from 4.0.0 through 4.0.6.5281; from 8.0.0 through 8.0.2.8191
• Oracle Corporation Primavera P6 Enterprise Project Portfolio Management: 18.8
• Oracle Retail Advanced Inventory Planning: 15.0
• Oracle Retail Assortment Planning: 14.1, 15.0, 16.0
• Oracle Retail Clearance Optimization Engine: 14.0.5
• Oracle Retail Customer Insights: 15.0, 16.0
• Oracle Retail Financial Integration: 13.2, 14.0, 14.1, 15.0, 16.0
• Oracle Corporation Oracle Retail Integration Bus: 14.1.2
• Oracle Retail Markdown Optimization: 13.4.4
• Oracle Retail Predictive Application Server: 14.0.3.26, 14.1.3.37, 15.0.3..100, 16.0
• Oracle Corporation Retail Xstore Point of Service: 7.1

How to fix

Upgrade to a fixed version: Oracle Corporation Communications Diameter Signaling Router (DSR) 8.3; Oracle Communications Performance Intelligence Center 10.2.1; Oracle Communications Services Gatekeeper 6.1.0.4.0; Spring Framework 4.3.18, 5.0.7; Spring Framework 5.0.7, 4.3.18. Check the vendor advisory for mitigations.

References

• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.securityfocus.com/bid/107984
• https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
• https://pivotal.io/security/cve-2018-11039
• https://www.oracle.com/security-alerts/cpujan2020.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.securityfocus.com/bid/107984

Get alerted when CVE-2018-11039 or the next vulnerability affects your stack