● CVE — Medium
CVE-2018-11039
Vendororacle, vmwareProductcommunications unified inventory management, hospitality guest access, agile product lifecycle management, communications services gatekeeper, enterprise manager ops center, communications diameter signaling router, spring framework, application testing suite, communications performance intelligence center, health sciences information manager, healthcare master person index, insurance calculation engine, insurance rules palette, retail customer insights, enterprise manager base platform, primavera p6 enterprise project portfolio management, endeca information discovery integrator, enterprise manager for mysql database, agile plm, communications network integrity, micros lucas, mysql enterprise monitor, retail assortment planning, communications online mediation controller, retail advanced inventory planning, retail clearance optimization engineDiscoveredJun 25, 2018UpdatedAug 25, 2026
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.