● CVE — High
CVE-2018-11040
Vendororacle, vmwareProductcommunications unified inventory management, hospitality guest access, agile product lifecycle management, communications services gatekeeper, enterprise manager ops center, retail xstore point of service, spring framework, application testing suite, healthcare master person index, insurance calculation engine, insurance rules palette, retail customer insights, retail predictive application server, flexcube private banking, endeca information discovery integrator, communications network integrity, micros lucas, mysql enterprise monitor, communications online mediation controller, retail advanced inventory planning, retail clearance optimization engine, enterprise manager, product lifecycle management, retail markdown optimization, retail service backboneDiscoveredJun 25, 2018UpdatedNov 21, 2024
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.