CVE-2018-11039

score

<0.1

cvss

5.9

epss

2.8%

published

2018-06-25

kev added

—

first seen

2026-10-21

Spring Framework versions 5.0.x prior to 5.0.7, 4.3.x prior to 4.3.18, and older unsupported versions contain an HTTP method change vulnerability caused by the HiddenHttpMethodFilter in Spring MVC, letting attackers escalate an existing XSS vulnerability to an XST attack, exploit requires an existing XSS flaw.