springframework: cross-domain requests via JSONP through AbstractJsonpResponseBodyAdvice
Published Jun 25, 2018
7.5
HIGHCVSS 3.1
EPSS 3.24%
Description
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
Affected products
-
- Version 4.3.xStatusaffectedConstraints<4.3.18
- Version 5.0.xStatusaffectedConstraints<5.0.7
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Pivotal | Spring Framework | n/a |
|
Configuration 1
- < 4.3.18
- ≥ 5.0.0 · < 5.0.7
Configuration 2
- 9.3.3
- 9.3.4
- 9.3.5
- 12.5.0.3
- 13.1.0.1
- 13.2.0.1
- 13.3.0.1
- ≥ 7.3.2 · ≤ 7.3.6
- 6.1
- < 6.1.0.4.0
- 7.3.2
- 7.3.4
- 7.3.5
- 7.4.0
- 3.1.0
- 3.2.0
- 13.2
- 12.3.3
- 2.0.0.0
- 2.2.0.1
- 12.0.1.0
- 12.0.3.0
- 12.1.0.0
- 3.0
- 4.0
- 4.2.0
- 4.2.1
- ≥ 11.0.0 · ≤ 11.3.1
- 10.0
- 10.2
- 2.9.5
- ≤ 3.4.9.4237
- ≥ 3.4.10 · ≤ 4.0.6.5281
- ≥ 4.0.7 · ≤ 8.0.2.8191
- 9.3.6
- 15.0
- 14.0.5
- 15.0
- 16.0
- 13.4.4
- 14.0.3.26
- 14.1.3.37
- 15.0.3.100
- 16.0
- 16.0.1
- 7.1
- 1.12.0.3
- 12.2.1.3.0
Configuration 3
- 9.0
No data.
Red Hat Fuse 7
springframework
Not affected
Red Hat JBoss BRMS 5
springframework
Out of support scope
Red Hat JBoss Data Virtualization 6
springframework
Out of support scope
Red Hat JBoss Fuse 6
springframework
Out of support scope
Red Hat JBoss Fuse Service Works 6
springframework
Out of support scope
Red Hat JBoss SOA Platform 5
springframework
Out of support scope
Red Hat OpenStack Platform 10 (Newton)
opendaylight
Will not fix
Red Hat OpenStack Platform 11 (Ocata)
opendaylight
Will not fix
Red Hat OpenStack Platform 12 (Pike)
opendaylight
Will not fix
Red Hat OpenStack Platform 13 (Queens)
opendaylight
Will not fix
Red Hat OpenStack Platform 9 (Mitaka)
opendaylight
Will not fix
Red Hat Storage 3
rhevm-dependencies
Not affected
Red Hat Virtualization 4
rhvm-dependencies
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Fuse 7 | springframework | Not affected | n/a |
| Red Hat JBoss BRMS 5 | springframework | Out of support scope | n/a |
| Red Hat JBoss Data Virtualization 6 | springframework | Out of support scope | n/a |
| Red Hat JBoss Fuse 6 | springframework | Out of support scope | n/a |
| Red Hat JBoss Fuse Service Works 6 | springframework | Out of support scope | n/a |
| Red Hat JBoss SOA Platform 5 | springframework | Out of support scope | n/a |
| Red Hat OpenStack Platform 10 (Newton) | opendaylight | Will not fix | n/a |
| Red Hat OpenStack Platform 11 (Ocata) | opendaylight | Will not fix | n/a |
| Red Hat OpenStack Platform 12 (Pike) | opendaylight | Will not fix | n/a |
| Red Hat OpenStack Platform 13 (Queens) | opendaylight | Will not fix | n/a |
| Red Hat OpenStack Platform 9 (Mitaka) | opendaylight | Will not fix | n/a |
| Red Hat Storage 3 | rhevm-dependencies | Not affected | n/a |
| Red Hat Virtualization 4 | rhvm-dependencies | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
From an OpenDaylight perspective, whilst the shipped versions of Open Dayight ship artifacts which fall within the affected versions ("older unsupported versions"), this flaw only has impact when JSONP is used in certain circumstances. Given the libraries themselves are not used in a vulnerable way, being only used as part of tests, no package update to mitigate this flaw for Open Daylight is required. The package rhevm-dependencies does not include the spring-webmvc component, where this vulnerability exists.
Red Hat mitigation
According to the upstream advisory, this vulnerability only applies to applications that do all of the following: * Explicitly configure MappingJackson2JsonView. * Do not set the jsonpParameterNames property of MappingJackson2JsonView to an empty set. * Expose sensitive user information over endpoints that can render content with JSONP.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1 other source (Red Hat) ▾
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
AV:N/AC:M/Au:N/C:P/I:N/A:N
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (29 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 3.24% (0.03244) | 87.87th | v5 (v2026.06.15) |
| Jun 15, 2026 | 3.24% (0.03244) | 86.65th | v5 (v2026.06.15) |
| Jun 6, 2026 | 6.56% (0.06564) | 91.32th | v4 (v2025.03.14) |
| Nov 21, 2025 | 8.25% (0.08246) | 91.87th | v4 (v2025.03.14) |
| Nov 18, 2025 | 3.55% (0.03550) | 86.51th | v4 (v2025.03.14) |
| Apr 21, 2025 | 8.54% (0.08537) | 91.87th | v4 (v2025.03.14) |
| Mar 30, 2025 | 6.30% (0.06303) | 90.00th | v4 (v2025.03.14) |
| Mar 29, 2025 | 45.50% (0.45502) | 96.47th | v4 (v2025.03.14) |
| Mar 24, 2025 | 6.30% (0.06303) | 90.00th | v4 (v2025.03.14) |
| Mar 23, 2025 | 21.35% (0.21353) | 94.97th | v4 (v2025.03.14) |
| Mar 17, 2025 | 6.30% (0.06303) | 90.25th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.24% (0.00245) | 65.10th | v3 (v2023.03.01) |
| May 23, 2024 | 0.26% (0.00264) | 66.10th | v3 (v2023.03.01) |
| Jan 19, 2024 | 0.26% (0.00264) | 64.09th | v3 (v2023.03.01) |
| Nov 16, 2023 | 0.34% (0.00336) | 68.12th | v3 (v2023.03.01) |
| Jul 8, 2023 | 0.39% (0.00390) | 69.64th | v3 (v2023.03.01) |
| Jun 19, 2023 | 0.51% (0.00513) | 73.36th | v3 (v2023.03.01) |
| May 8, 2023 | 0.47% (0.00472) | 71.96th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.36% (0.00359) | 67.77th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.54% (0.01537) | 74.52th | v2 (v2022.01.01) |
| Feb 23, 2023 | 1.54% (0.01537) | 74.48th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.54% (0.01537) | 72.41th | v2 (v2022.01.01) |
| Feb 4, 2022 | 1.54% (0.01537) | 51.33th | v2 (v2022.01.01) |
| Feb 3, 2022 | 2.20% (0.02196) | 50.61th | v1 |
| Jan 6, 2022 | 2.20% (0.02196) | 50.11th | v1 |
| Oct 21, 2021 | 2.20% (0.02196) | 77.79th | v1 |
| Sep 1, 2021 | 1.98% (0.01979) | 76.71th | v1 |
| Apr 27, 2021 | 1.98% (0.01979) | 0.00th | v1 |
| Apr 14, 2021 | 1.76% (0.01762) | 0.00th | v1 |
References (16)
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html x_refsource_CONFIRMPatchThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2018-11040 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1591931 Issue Tracking
- https://github.com/advisories/GHSA-f26x-pr96-vw86 Advisory
- https://github.com/spring-projects/spring-framework/commit/874859493bbda59739c38c7e52eb3625f247b93a
- https://github.com/spring-projects/spring-framework/commit/b80c13b722bb207ddf43f53a007ee3ddc1dd2e26
- https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-11040
- https://pivotal.io/security/cve-2018-11040 x_refsource_CONFIRMMitigationVendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2018-11040
- https://www.oracle.com/security-alerts/cpujan2020.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html x_refsource_CONFIRMPatchThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html x_refsource_MISCPatchThird Party Advisory
Change history (0)
No recorded changes yet.