CVE-2018-11039: debian debian_linux
Vulnerability summary
CVE-2018-11039 is a medium (CVSS 5.9) vulnerability in debian debian_linux. EPSS estimates a 2.75% chance of exploitation in the next 30 days, higher than 85.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 25-06-2018PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · MavenEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
2.75%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.75% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle31 products
- agile_product_lifecycle_management9.3.3 | 9.3.4 | 9.3.5 | 9.3.6
- application_testing_suite12.5.0.3 | 13.1.0.1 | 13.2.0.1 | 13.3.0.1
- communications_diameter_signaling_router< 8.3
- communications_network_integrity≥ 7.3.2, ≤ 7.3.6
- communications_online_mediation_controller6.1
Debian2 products
- libspring-java< 4.3.19-1
- debian_linuxEOL9.0
Org.springframework1 product
- spring-web≥ 5.0.0, < 5.0.7 | ≥ 4.3.0, < 4.3.18
Pivotal1 product
- spring framework≥ 5.0.x, < 5.0.7 | ≥ 4.3.x, < 4.3.18
Ubuntu1 product
- libspring-javaAll versions (No fix recorded)
Vmware1 product
- spring_framework< 4.3.18 | ≥ 5.0.0, < 5.0.7
6 vendors · 37 products
References
23 links- www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlX Refsource MISCPatchThird Party AdvisoryWEB
lists.debian.org/debian-lts-announce/2021/04/msg00022.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB
