{"id":"CVE-2018-11039","title":"Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilt…","summary":"Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilt…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"vmware","product":"spring_framework","affected":["spring_framework < 4.3.18","spring_framework >= 5.0.0, < 5.0.7","agile_product_lifecycle_management = 9.3.3","agile_product_lifecycle_management = 9.3.4","agile_product_lifecycle_management = 9.3.5","agile_product_lifecycle_management = 9.3.6","application_testing_suite = 12.5.0.3","application_testing_suite = 13.1.0.1","application_testing_suite = 13.2.0.1","application_testing_suite = 13.3.0.1","communications_diameter_signaling_router < 8.3","communications_network_integrity >= 7.3.2, <= 7.3.6","communications_online_mediation_controller = 6.1","communications_performance_intelligence_center < 10.2.1","communications_services_gatekeeper < 6.1.0.4.0","communications_unified_inventory_management = 7.3.2","communications_unified_inventory_management = 7.3.4","communications_unified_inventory_management = 7.3.5","communications_unified_inventory_management = 7.4.0","endeca_information_discovery_integrator = 3.1.0","endeca_information_discovery_integrator = 3.2.0","enterprise_manager_base_platform = 12.1.0.5.0","enterprise_manager_base_platform = 13.2.0.0.0","enterprise_manager_base_platform = 13.3.0.0.0","enterprise_manager_for_mysql_database = 13.2","enterprise_manager_ops_center = 12.3.3","health_sciences_information_manager = 3.0","healthcare_master_person_index = 3.0","healthcare_master_person_index = 4.0","hospitality_guest_access = 4.2.0","hospitality_guest_access = 4.2.1","insurance_calculation_engine >= 11.0.0, <= 11.3.1","insurance_calculation_engine = 10.2","insurance_rules_palette = 10.0","insurance_rules_palette = 10.2","micros_lucas = 2.9.5","mysql_enterprise_monitor <= 3.4.9.4237","mysql_enterprise_monitor >= 4.0.0, <= 4.0.6.5281","mysql_enterprise_monitor >= 8.0.0, <= 8.0.2.8191","primavera_p6_enterprise_project_portfolio_management = 18.8","retail_advanced_inventory_planning = 15.0","retail_assortment_planning = 14.1","retail_assortment_planning = 15.0","retail_assortment_planning = 16.0","retail_clearance_optimization_engine = 14.0.5","retail_customer_insights = 15.0","retail_customer_insights = 16.0","retail_financial_integration = 13.2","retail_financial_integration = 14.0","retail_financial_integration = 14.1","retail_financial_integration = 15.0","retail_financial_integration = 16.0","retail_integration_bus = 14.1.2","retail_markdown_optimization = 13.4.4","retail_predictive_application_server = 14.0.3.26","retail_predictive_application_server = 14.1.3.37","retail_predictive_application_server = 15.0.3..100","retail_predictive_application_server = 16.0","retail_xstore_point_of_service = 7.1","utilities_network_management_system = 1.12.0.3","weblogic_server = 10.3.6.0.0","weblogic_server = 12.1.3.0.0","weblogic_server = 12.2.1.3.0","debian_linux = 9.0"],"patched":["spring_framework 5.0.7","communications_diameter_signaling_router 8.3","communications_performance_intelligence_center 10.2.1","communications_services_gatekeeper 6.1.0.4.0"],"published":"2018-06-25","updated":"2026-08-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-11039","references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","label":"security_alert@emc.com"},{"url":"http://www.securityfocus.com/bid/107984","label":"security_alert@emc.com"},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html","label":"security_alert@emc.com"},{"url":"https://pivotal.io/security/cve-2018-11039","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","label":"security_alert@emc.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/107984","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://pivotal.io/security/cve-2018-11039","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.02746,"epssPercentile":0.85467,"ingestedAt":"2026-08-25T17:29:29.152Z","slug":"CVE-2018-11039","body":"## Overview\n\nSpring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.\n\n## Affected\n\n- `spring_framework < 4.3.18`\n- `spring_framework >= 5.0.0, < 5.0.7`\n- `agile_product_lifecycle_management = 9.3.3`\n- `agile_product_lifecycle_management = 9.3.4`\n- `agile_product_lifecycle_management = 9.3.5`\n- `agile_product_lifecycle_management = 9.3.6`\n- `application_testing_suite = 12.5.0.3`\n- `application_testing_suite = 13.1.0.1`\n- `application_testing_suite = 13.2.0.1`\n- `application_testing_suite = 13.3.0.1`\n- `communications_diameter_signaling_router < 8.3`\n- `communications_network_integrity >= 7.3.2, <= 7.3.6`\n- `communications_online_mediation_controller = 6.1`\n- `communications_performance_intelligence_center < 10.2.1`\n- `communications_services_gatekeeper < 6.1.0.4.0`\n- `communications_unified_inventory_management = 7.3.2`\n- `communications_unified_inventory_management = 7.3.4`\n- `communications_unified_inventory_management = 7.3.5`\n- `communications_unified_inventory_management = 7.4.0`\n- `endeca_information_discovery_integrator = 3.1.0`\n- `endeca_information_discovery_integrator = 3.2.0`\n- `enterprise_manager_base_platform = 12.1.0.5.0`\n- `enterprise_manager_base_platform = 13.2.0.0.0`\n- `enterprise_manager_base_platform = 13.3.0.0.0`\n- `enterprise_manager_for_mysql_database = 13.2`\n- `enterprise_manager_ops_center = 12.3.3`\n- `health_sciences_information_manager = 3.0`\n- `healthcare_master_person_index = 3.0`\n- `healthcare_master_person_index = 4.0`\n- `hospitality_guest_access = 4.2.0`\n- `hospitality_guest_access = 4.2.1`\n- `insurance_calculation_engine >= 11.0.0, <= 11.3.1`\n- `insurance_calculation_engine = 10.2`\n- `insurance_rules_palette = 10.0`\n- `insurance_rules_palette = 10.2`\n- `micros_lucas = 2.9.5`\n- `mysql_enterprise_monitor <= 3.4.9.4237`\n- `mysql_enterprise_monitor >= 4.0.0, <= 4.0.6.5281`\n- `mysql_enterprise_monitor >= 8.0.0, <= 8.0.2.8191`\n- `primavera_p6_enterprise_project_portfolio_management = 18.8`\n- `retail_advanced_inventory_planning = 15.0`\n- `retail_assortment_planning = 14.1`\n- `retail_assortment_planning = 15.0`\n- `retail_assortment_planning = 16.0`\n- `retail_clearance_optimization_engine = 14.0.5`\n- `retail_customer_insights = 15.0`\n- `retail_customer_insights = 16.0`\n- `retail_financial_integration = 13.2`\n- `retail_financial_integration = 14.0`\n- `retail_financial_integration = 14.1`\n- `retail_financial_integration = 15.0`\n- `retail_financial_integration = 16.0`\n- `retail_integration_bus = 14.1.2`\n- `retail_markdown_optimization = 13.4.4`\n- `retail_predictive_application_server = 14.0.3.26`\n- `retail_predictive_application_server = 14.1.3.37`\n- `retail_predictive_application_server = 15.0.3..100`\n- `retail_predictive_application_server = 16.0`\n- `retail_xstore_point_of_service = 7.1`\n- `utilities_network_management_system = 1.12.0.3`\n- `weblogic_server = 10.3.6.0.0`\n- `weblogic_server = 12.1.3.0.0`\n- `weblogic_server = 12.2.1.3.0`\n- `debian_linux = 9.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `spring_framework 5.0.7`\n- `communications_diameter_signaling_router 8.3`\n- `communications_performance_intelligence_center 10.2.1`\n- `communications_services_gatekeeper 6.1.0.4.0`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.5,"exploitation":0,"ransomware":0},"changes":[]}