--- id: CVE-2018-11039 title: >- Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilt… summary: >- Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilt… severity: medium cvss: 5.9 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N' vendor: vmware product: spring_framework affected: - spring_framework < 4.3.18 - 'spring_framework >= 5.0.0, < 5.0.7' - agile_product_lifecycle_management = 9.3.3 - agile_product_lifecycle_management = 9.3.4 - agile_product_lifecycle_management = 9.3.5 - agile_product_lifecycle_management = 9.3.6 - application_testing_suite = 12.5.0.3 - application_testing_suite = 13.1.0.1 - application_testing_suite = 13.2.0.1 - application_testing_suite = 13.3.0.1 - communications_diameter_signaling_router < 8.3 - 'communications_network_integrity >= 7.3.2, <= 7.3.6' - communications_online_mediation_controller = 6.1 - communications_performance_intelligence_center < 10.2.1 - communications_services_gatekeeper < 6.1.0.4.0 - communications_unified_inventory_management = 7.3.2 - communications_unified_inventory_management = 7.3.4 - communications_unified_inventory_management = 7.3.5 - communications_unified_inventory_management = 7.4.0 - endeca_information_discovery_integrator = 3.1.0 - endeca_information_discovery_integrator = 3.2.0 - enterprise_manager_base_platform = 12.1.0.5.0 - enterprise_manager_base_platform = 13.2.0.0.0 - enterprise_manager_base_platform = 13.3.0.0.0 - enterprise_manager_for_mysql_database = 13.2 - enterprise_manager_ops_center = 12.3.3 - health_sciences_information_manager = 3.0 - healthcare_master_person_index = 3.0 - healthcare_master_person_index = 4.0 - hospitality_guest_access = 4.2.0 - hospitality_guest_access = 4.2.1 - 'insurance_calculation_engine >= 11.0.0, <= 11.3.1' - insurance_calculation_engine = 10.2 - insurance_rules_palette = 10.0 - insurance_rules_palette = 10.2 - micros_lucas = 2.9.5 - mysql_enterprise_monitor <= 3.4.9.4237 - 'mysql_enterprise_monitor >= 4.0.0, <= 4.0.6.5281' - 'mysql_enterprise_monitor >= 8.0.0, <= 8.0.2.8191' - primavera_p6_enterprise_project_portfolio_management = 18.8 - retail_advanced_inventory_planning = 15.0 - retail_assortment_planning = 14.1 - retail_assortment_planning = 15.0 - retail_assortment_planning = 16.0 - retail_clearance_optimization_engine = 14.0.5 - retail_customer_insights = 15.0 - retail_customer_insights = 16.0 - retail_financial_integration = 13.2 - retail_financial_integration = 14.0 - retail_financial_integration = 14.1 - retail_financial_integration = 15.0 - retail_financial_integration = 16.0 - retail_integration_bus = 14.1.2 - retail_markdown_optimization = 13.4.4 - retail_predictive_application_server = 14.0.3.26 - retail_predictive_application_server = 14.1.3.37 - retail_predictive_application_server = 15.0.3..100 - retail_predictive_application_server = 16.0 - retail_xstore_point_of_service = 7.1 - utilities_network_management_system = 1.12.0.3 - weblogic_server = 10.3.6.0.0 - weblogic_server = 12.1.3.0.0 - weblogic_server = 12.2.1.3.0 - debian_linux = 9.0 patched: - spring_framework 5.0.7 - communications_diameter_signaling_router 8.3 - communications_performance_intelligence_center 10.2.1 - communications_services_gatekeeper 6.1.0.4.0 published: '2018-06-25' updated: '2026-08-25' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-11039' references: - url: >- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html label: security_alert@emc.com - url: 'http://www.securityfocus.com/bid/107984' label: security_alert@emc.com - url: 'https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html' label: security_alert@emc.com - url: 'https://pivotal.io/security/cve-2018-11039' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: security_alert@emc.com - url: >- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html label: security_alert@emc.com - url: >- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html label: security_alert@emc.com - url: >- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html label: security_alert@emc.com - url: >- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securityfocus.com/bid/107984' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://pivotal.io/security/cve-2018-11039' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.02746 epssPercentile: 0.85581 ingestedAt: '2026-08-25T17:29:29.152Z' --- ## Overview Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack. ## Affected - `spring_framework < 4.3.18` - `spring_framework >= 5.0.0, < 5.0.7` - `agile_product_lifecycle_management = 9.3.3` - `agile_product_lifecycle_management = 9.3.4` - `agile_product_lifecycle_management = 9.3.5` - `agile_product_lifecycle_management = 9.3.6` - `application_testing_suite = 12.5.0.3` - `application_testing_suite = 13.1.0.1` - `application_testing_suite = 13.2.0.1` - `application_testing_suite = 13.3.0.1` - `communications_diameter_signaling_router < 8.3` - `communications_network_integrity >= 7.3.2, <= 7.3.6` - `communications_online_mediation_controller = 6.1` - `communications_performance_intelligence_center < 10.2.1` - `communications_services_gatekeeper < 6.1.0.4.0` - `communications_unified_inventory_management = 7.3.2` - `communications_unified_inventory_management = 7.3.4` - `communications_unified_inventory_management = 7.3.5` - `communications_unified_inventory_management = 7.4.0` - `endeca_information_discovery_integrator = 3.1.0` - `endeca_information_discovery_integrator = 3.2.0` - `enterprise_manager_base_platform = 12.1.0.5.0` - `enterprise_manager_base_platform = 13.2.0.0.0` - `enterprise_manager_base_platform = 13.3.0.0.0` - `enterprise_manager_for_mysql_database = 13.2` - `enterprise_manager_ops_center = 12.3.3` - `health_sciences_information_manager = 3.0` - `healthcare_master_person_index = 3.0` - `healthcare_master_person_index = 4.0` - `hospitality_guest_access = 4.2.0` - `hospitality_guest_access = 4.2.1` - `insurance_calculation_engine >= 11.0.0, <= 11.3.1` - `insurance_calculation_engine = 10.2` - `insurance_rules_palette = 10.0` - `insurance_rules_palette = 10.2` - `micros_lucas = 2.9.5` - `mysql_enterprise_monitor <= 3.4.9.4237` - `mysql_enterprise_monitor >= 4.0.0, <= 4.0.6.5281` - `mysql_enterprise_monitor >= 8.0.0, <= 8.0.2.8191` - `primavera_p6_enterprise_project_portfolio_management = 18.8` - `retail_advanced_inventory_planning = 15.0` - `retail_assortment_planning = 14.1` - `retail_assortment_planning = 15.0` - `retail_assortment_planning = 16.0` - `retail_clearance_optimization_engine = 14.0.5` - `retail_customer_insights = 15.0` - `retail_customer_insights = 16.0` - `retail_financial_integration = 13.2` - `retail_financial_integration = 14.0` - `retail_financial_integration = 14.1` - `retail_financial_integration = 15.0` - `retail_financial_integration = 16.0` - `retail_integration_bus = 14.1.2` - `retail_markdown_optimization = 13.4.4` - `retail_predictive_application_server = 14.0.3.26` - `retail_predictive_application_server = 14.1.3.37` - `retail_predictive_application_server = 15.0.3..100` - `retail_predictive_application_server = 16.0` - `retail_xstore_point_of_service = 7.1` - `utilities_network_management_system = 1.12.0.3` - `weblogic_server = 10.3.6.0.0` - `weblogic_server = 12.1.3.0.0` - `weblogic_server = 12.2.1.3.0` - `debian_linux = 9.0` ## Remediation Upgrade past the affected range: - `spring_framework 5.0.7` - `communications_diameter_signaling_router 8.3` - `communications_performance_intelligence_center 10.2.1` - `communications_services_gatekeeper 6.1.0.4.0`