CVE-2018-11039: Vulnerability in org.springframework:spring-core
Summary
CVE-2018-11039: Spring Framework Cross Site Tracing (XST). Affects org.springframework:spring-web across 2 version ranges.
>= 4.3.0, < 4.3.18
>= 5.0.0, < 5.0.7
Fixed in 4.3.18 or 5.0.7, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2018-11039 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.springframework:spring-core is a widely used package in the Maven ecosystem. It provides core functionality for the Spring Framework, including dependency injection and inversion of control. This package is vulnerable to a moderate severity issue that allows web applications to change the HTTP request method to any method, including TRACE, using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, an attacker can exploit this filter to escalate to a Cross Site Tracing (XST) attack.
Vulnerability Detail
The vulnerability in org.springframework:spring-core arises from the HiddenHttpMethodFilter in Spring MVC. This filter allows web applications to change the HTTP request method to any method, including TRACE. If an application has a pre-existing XSS vulnerability, an attacker can use this filter to perform a Cross Site Tracing (XST) attack. This can lead to unauthorized access, data leakage, and potential compromise of user accounts. The vulnerability has a CVSS score of 5.9, indicating a moderate severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.0, < 4.3.184.3.18 -
>= 5.0.0, < 5.0.75.0.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to upgrade to a fixed version of org.springframework:spring-core.
Conclusion
The vulnerability in org.springframework:spring-core allows web applications to change the HTTP request method to any method, including TRACE, leading to a potential Cross Site Tracing (XST) attack. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of org.springframework:spring-core and address any pre-existing XSS vulnerabilities in the application. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-web →
FAQ
org.springframework:spring-core is a package in the Maven ecosystem that provides core functionality for the Spring Framework, including dependency injection and inversion of control.
The vulnerability allows an attacker to perform a Cross Site Tracing (XST) attack if the application has a pre-existing XSS vulnerability. This can lead to unauthorized access, data leakage, and potential compromise of user accounts.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity.
To fix this vulnerability, it is recommended to upgrade to a fixed version of org.springframework:spring-core. For versions 5.0.x, upgrade to version 5.0.7 or later. For versions 4.3.x, upgrade to version 4.3.18 or later. It is also important to address any pre-existing XSS vulnerabilities in the application.
There is no specific workaround provided for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to upgrade to a fixed version of org.springframework:spring-core.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-web.
