CVE-2018-11040
Description
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
How to fix
- vmware spring_framework4.3.18, 5.0.7 or later
- oracle communications_services_gatekeeper6.1.0.4.0 or later
- org.springframework:spring-core5.0.7.RELEASE, 4.3.18.RELEASE or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware spring_framework | v < 4.3.18, 5.0.0 ≤ v < 5.0.7 | 4.3.18, 5.0.7 |
| oracle agile_product_lifecycle_management | 9.3.3, 9.3.4, 9.3.5 | — |
| oracle application_testing_suite | 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1 | — |
| oracle communications_network_integrity | 7.3.2 ≤ v ≤ 7.3.6 | — |
| oracle communications_online_mediation_controller | 6.1 | — |
| oracle communications_services_gatekeeper | v < 6.1.0.4.0 | 6.1.0.4.0 |
| oracle communications_unified_inventory_management | 7.3.2, 7.3.4, 7.3.5, 7.4.0 | — |
| oracle endeca_information_discovery_integrator | 3.1.0, 3.2.0 | — |
| oracle enterprise_manager | 13.2 | — |
| oracle enterprise_manager_ops_center | 12.3.3 | — |
| oracle flexcube_private_banking | 2.0.0.0, 2.2.0.1, 12.0.1.0, 12.0.3.0, 12.1.0.0 | — |
| oracle healthcare_master_person_index | 3.0, 4.0 | — |
| oracle hospitality_guest_access | 4.2.0, 4.2.1 | — |
| oracle insurance_calculation_engine | 11.0.0 ≤ v ≤ 11.3.1 | — |
| oracle insurance_rules_palette | 10.0, 10.2 | — |
| oracle micros_lucas | 2.9.5 | — |
| oracle mysql_enterprise_monitor | v ≤ 3.4.9.4237, 3.4.10 ≤ v ≤ 4.0.6.5281, 4.0.7 ≤ v ≤ 8.0.2.8191 | — |
| oracle product_lifecycle_management | 9.3.6 | — |
| oracle retail_advanced_inventory_planning | 15.0 | — |
| oracle retail_clearance_optimization_engine | 14.0.5 | — |
| oracle retail_customer_insights | 15.0, 16.0 | — |
| oracle retail_markdown_optimization | 13.4.4 | — |
| oracle retail_predictive_application_server | 14.0.3.26, 14.1.3.37, 15.0.3.100, 16.0 | — |
| oracle retail_service_backbone | 16.0.1 | — |
| oracle retail_xstore_point_of_service | 7.1 | — |
| oracle utilities_network_management_system | 1.12.0.3 | — |
| oracle weblogic_server | 12.2.1.3.0 | — |
| debian debian_linux | 9.0 | — |
| org.springframework:spring-coreMaven | 5.0.0.RELEASE ≤ v < 5.0.7.RELEASE, 4.3.0.RELEASE ≤ v < 4.3.18.RELEASE | 5.0.7.RELEASE, 4.3.18.RELEASE |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.