springframework: Cross Site Tracing (XST) if vulnerable to XSS
Published Jun 25, 2018
5.9
MEDIUMCVSS 3.1
EPSS 2.75%
Description
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
Affected products
-
- Version 4.3.xStatusaffectedConstraints<4.3.18
- Version 5.0.xStatusaffectedConstraints<5.0.7
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Pivotal | Spring Framework | n/a |
|
Configuration 1
- < 4.3.18
- ≥ 5.0.0 · < 5.0.7
Configuration 2
- 9.3.3
- 9.3.4
- 9.3.5
- 9.3.6
- 12.5.0.3
- 13.1.0.1
- 13.2.0.1
- 13.3.0.1
- < 8.3
- ≥ 7.3.2 · ≤ 7.3.6
- 6.1
- < 10.2.1
- < 6.1.0.4.0
- 7.3.2
- 7.3.4
- 7.3.5
- 7.4.0
- 3.1.0
- 3.2.0
- 12.1.0.5.0
- 13.2.0.0.0
- 13.3.0.0.0
- 13.2
- 12.3.3
- 3.0
- 3.0
- 4.0
- 4.2.0
- 4.2.1
- ≥ 11.0.0 · ≤ 11.3.1
- 10.2
- 10.0
- 10.2
- 2.9.5
- ≤ 3.4.9.4237
- ≥ 4.0.0 · ≤ 4.0.6.5281
- ≥ 8.0.0 · ≤ 8.0.2.8191
- 18.8
- 15.0
- 14.1
- 15.0
- 16.0
- 14.0.5
- 15.0
- 16.0
- 13.2
- 14.0
- 14.1
- 15.0
- 16.0
- 14.1.2
- 13.4.4
- 14.0.3.26
- 14.1.3.37
- 15.0.3..100
- 16.0
- 7.1
- 1.12.0.3
- 10.3.6.0.0
- 12.1.3.0.0
- 12.2.1.3.0
Configuration 3
- 9.0
No data.
Red Hat Fuse 7
springframework
Not affected
Red Hat JBoss BRMS 5
springframework
Out of support scope
Red Hat JBoss Data Virtualization 6
springframework
Out of support scope
Red Hat JBoss Fuse 6
springframework
Out of support scope
Red Hat JBoss Fuse Service Works 6
springframework
Out of support scope
Red Hat JBoss SOA Platform 5
springframework
Out of support scope
Red Hat OpenStack Platform 10 (Newton)
opendaylight
Will not fix
Red Hat OpenStack Platform 11 (Ocata)
opendaylight
Will not fix
Red Hat OpenStack Platform 12 (Pike)
opendaylight
Will not fix
Red Hat OpenStack Platform 13 (Queens)
opendaylight
Will not fix
Red Hat OpenStack Platform 9 (Mitaka)
opendaylight
Will not fix
Red Hat Storage 3
rhevm-dependencies
Not affected
Red Hat Virtualization 4
rhvm-dependencies
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Fuse 7 | springframework | Not affected | n/a |
| Red Hat JBoss BRMS 5 | springframework | Out of support scope | n/a |
| Red Hat JBoss Data Virtualization 6 | springframework | Out of support scope | n/a |
| Red Hat JBoss Fuse 6 | springframework | Out of support scope | n/a |
| Red Hat JBoss Fuse Service Works 6 | springframework | Out of support scope | n/a |
| Red Hat JBoss SOA Platform 5 | springframework | Out of support scope | n/a |
| Red Hat OpenStack Platform 10 (Newton) | opendaylight | Will not fix | n/a |
| Red Hat OpenStack Platform 11 (Ocata) | opendaylight | Will not fix | n/a |
| Red Hat OpenStack Platform 12 (Pike) | opendaylight | Will not fix | n/a |
| Red Hat OpenStack Platform 13 (Queens) | opendaylight | Will not fix | n/a |
| Red Hat OpenStack Platform 9 (Mitaka) | opendaylight | Will not fix | n/a |
| Red Hat Storage 3 | rhevm-dependencies | Not affected | n/a |
| Red Hat Virtualization 4 | rhvm-dependencies | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
From an OpenDaylight perspective, whilst the shipped versions of Open Dayight ship artifacts which fall within the affected versions ("older unsupported versions"), this flaw only has impact in the presence of an existing XSS flaw. Given there are currently no XSS flaws in the shipped versions, and the libraries themselves are not used in a vulnerable way, no package update to mitigate this flaw for Open Daylight is required. The package rhevm-dependencies does not include the spring-webmvc component, where this vulnerability exists.
Red Hat mitigation
According to the upstream advisory, this attack applies to applications that allow the application server to handle HTTP TRACE requests, and use the HiddenHttpMethodFilter. Note that in the HiddenHttpMethodFilter is enabled by default in Spring Boot.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
AV:N/AC:M/Au:N/C:P/I:N/A:N
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Percentile over time
- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Table of values (18 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 2.75% (0.02746) | 85.66th | v5 (v2026.06.15) |
| Jun 15, 2026 | 2.78% (0.02781) | 84.46th | v5 (v2026.06.15) |
| Nov 21, 2025 | 2.92% (0.02919) | 85.90th | v4 (v2025.03.14) |
| Nov 18, 2025 | 1.75% (0.01755) | 81.09th | v4 (v2025.03.14) |
| Apr 14, 2025 | 3.13% (0.03130) | 85.75th | v4 (v2025.03.14) |
| Mar 30, 2025 | 1.44% (0.01441) | 78.93th | v4 (v2025.03.14) |
| Mar 29, 2025 | 3.73% (0.03726) | 79.73th | v4 (v2025.03.14) |
| Mar 17, 2025 | 1.63% (0.01629) | 80.60th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.24% (0.00245) | 65.07th | v3 (v2023.03.01) |
| May 18, 2024 | 0.26% (0.00264) | 66.00th | v3 (v2023.03.01) |
| Dec 26, 2023 | 0.26% (0.00264) | 63.98th | v3 (v2023.03.01) |
| Nov 16, 2023 | 0.23% (0.00227) | 60.81th | v3 (v2023.03.01) |
| Sep 3, 2023 | 0.22% (0.00219) | 59.17th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.20% (0.00202) | 56.32th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.54% (0.01537) | 74.52th | v2 (v2022.01.01) |
| Feb 4, 2022 | 1.54% (0.01537) | 51.33th | v2 (v2022.01.01) |
| Feb 3, 2022 | 2.41% (0.02412) | 53.86th | v5 (v2026.06.15) |
| Apr 14, 2021 | 1.98% (0.01979) | 0.00th | v1 |
References (22)
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html x_refsource_CONFIRMPatchThird Party Advisory
- http://www.securityfocus.com/bid/107984 vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2018-11039 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1591929 Issue Tracking
- https://github.com/advisories/GHSA-9gcm-f4x3-8jpw Advisory
- https://github.com/spring-projects/spring-framework/commit/323ccf99e575343f63d56e229c25c35c170b7ec1
- https://github.com/spring-projects/spring-framework/commit/a5cd01a4c857aaaba7ccc51545fc73dd25b5cba5
- https://github.com/spring-projects/spring-framework/commit/dac97f1b7dac3e70ff603fb6fc9f205b95dd6b01
- https://github.com/spring-projects/spring-framework/commit/f2694a8ed93f1f63f87ce45d0bb638478b426acd
- https://github.com/spring-projects/spring-framework/commit/f64fa3dea10af125d612d3a997aece93d21bc875
- https://github.com/spring-projects/spring-framework/issues/21376
- https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-11039
- https://pivotal.io/security/cve-2018-11039 x_refsource_CONFIRMMitigationVendor Advisory
- https://spring.io/security/cve-2018-11039
- https://www.cve.org/CVERecord?id=CVE-2018-11039
- https://www.oracle.com/security-alerts/cpujan2020.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html x_refsource_CONFIRMPatchThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html x_refsource_MISCPatchThird Party Advisory
Change history (0)
No recorded changes yet.