What’s Vulnerable › Vulnerabilities
CVE-2018-11040
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-06-25 · updated 2026-10-08
- Weakness: CWE-829
Description
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
Affected products
- Debian Linux: 9.0
- Oracle Corporation Oracle Agile PLM: 9.3.3, 9.3.4, 9.3.5
- Oracle Corporation Oracle Application Testing Suite: 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1
- Oracle Communications Network Integrity: from 7.3.2 through 7.3.6
- Oracle Communications Online Mediation Controller: 6.1
- Oracle Communications Services Gatekeeper: before 6.1.0.4.0 — fixed in 6.1.0.4.0
- Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.2, 7.3.4, 7.3.5, 7.4.0
- Oracle Corporation Endeca Information Discovery Integrator: 3.1.0, 3.2.0
- Oracle Corporation Enterprise Manager for Fusion Middleware: 13.2
- Oracle Corporation Enterprise Manager Ops Center: 12.3.3
- Oracle Corporation FLEXCUBE Private Banking: 2.0.0.0, 2.2.0.1, 12.0.1.0, 12.0.3.0, 12.1.0.0
- Oracle Healthcare Master Person Index: 3.0, 4.0
- Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
- Oracle Insurance Calculation Engine: from 11.0.0 through 11.3.1
- Oracle Insurance Rules Palette: 10.0, 10.2
- Oracle Corporation MICROS Lucas: 2.9.5
- Oracle Corporation MySQL Enterprise Monitor: through 3.4.9.4237; from 3.4.10 through 4.0.6.5281; from 4.0.7 through 8.0.2.8191
- Oracle Product Lifecycle Management: 9.3.6
- Oracle Retail Advanced Inventory Planning: 15.0
- Oracle Retail Clearance Optimization Engine: 14.0.5
- Oracle Retail Customer Insights: 15.0, 16.0
- Oracle Retail Markdown Optimization: 13.4.4
- Oracle Retail Predictive Application Server: 14.0.3.26, 14.1.3.37, 15.0.3.100, 16.0
- Oracle Retail Service Backbone: 16.0.1
- Oracle Corporation Retail Xstore Point of Service: 7.1
- Oracle Corporation Oracle Utilities Network Management System: 1.12.0.3
- Oracle WebLogic Server: 12.2.1.3.0
- Spring Framework: before 4.3.18; from 5.0.0 before 5.0.7 — fixed in 4.3.18, 5.0.7
- Spring Framework: from 5.0.x before 5.0.7; from 4.3.x before 4.3.18 — fixed in 5.0.7, 4.3.18
How to fix
Upgrade to a fixed version: Oracle Communications Services Gatekeeper 6.1.0.4.0; Spring Framework 4.3.18, 5.0.7; Spring Framework 5.0.7, 4.3.18. Check the vendor advisory for mitigations.
References
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
- https://pivotal.io/security/cve-2018-11040
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
- https://pivotal.io/security/cve-2018-11040
Get alerted when CVE-2018-11040 or the next vulnerability affects your stack