CVE-2018-11040 Moderate severity vulnerability that affects org.springframework:spring-core
Spring Framework allows cross-domain requests via JSONP when configured, potentially bypassing same-origin policy restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-11040?
CVE-2018-11040 is a high-severity vulnerability in Debian Debian Linux, published on 25 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
Weakness: CWE-829
Which versions are affected by CVE-2018-11040?
4 open source packages ship an affected version, including org.springframework:spring-core. It affects 28 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework:spring-core Maven | From 4.3.0.RELEASE | 4.3.18.RELEASE |
org.springframework:spring-core Maven | From 4.3.0.RELEASE | 4.3.18.RELEASE |
org.springframework:spring-core Maven | From 5.0.0.RELEASE | 5.0.7.RELEASE |
org.springframework:spring-core Maven | From 5.0.0.RELEASE | 5.0.7.RELEASE |
Products include Debian Debian Linux, Oracle Agile Product Lifecycle Management, Oracle Application Testing Suite, Oracle Communications Network Integrity, Oracle Communications Online Mediation Controller, Oracle Communications Services Gatekeeper and 22 more.
How do I fix CVE-2018-11040?
Upgrade org.springframework:spring-core to a fixed version for your release line: 4.3.18.RELEASE or 5.0.7.RELEASE.
Is CVE-2018-11040 being exploited?
There is no known exploitation of CVE-2018-11040 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-11040, GHSA-f26x-pr96-vw86, UBUNTU-CVE-2018-11040.