onyx --cves cve-2018-11040
CVE-2018-11040
- score
- <0.1
- cvss
- 7.5
- epss
- 3.2%
- published
- 2018-06-25
- kev added
- —
- first seen
Spring Framework versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18, including unsupported versions, contain a cross-site request forgery caused by automatic JSONP support in AbstractJsonpResponseBodyAdvice and MappingJackson2JsonView, letting malicious websites perform cross-domain requests, exploit requires configuration of MappingJackson2JsonView with JSONP parameters.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 9
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://pivotal.io/security/cve-2018-11040
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html