CVE-2018-11040: debian debian_linux
Vulnerability summary
CVE-2018-11040 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 3.23% chance of exploitation in the next 30 days, higher than 88% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 25-06-2018PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
CVSS metrics
5 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
3.23%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
-0.01 pp
From 3.24% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Oracle26 products
- agile_product_lifecycle_management9.3.3 | 9.3.4 | 9.3.5
- application_testing_suite12.5.0.3 | 13.1.0.1 | 13.2.0.1 | 13.3.0.1
- communications_network_integrity≥ 7.3.2, ≤ 7.3.6
- communications_online_mediation_controller6.1
- communications_services_gatekeeper< 6.1.0.4.0
Debian2 products
- libspring-java< 4.3.19-1
- debian_linuxEOL9.0
Org.springframework1 product
- spring-core≥ 5.0.0.RELEASE, < 5.0.7.RELEASE | ≥ 4.3.0.RELEASE, < 4.3.18.RELEASE
Pivotal1 product
- spring framework≥ 5.0.x, < 5.0.7 | ≥ 4.3.x, < 4.3.18
Ubuntu1 product
- libspring-javaAll versions (No fix recorded)
Vmware1 product
- spring_framework< 4.3.18 | ≥ 5.0.0, < 5.0.7
6 vendors · 32 products
References
17 links- www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlX Refsource MISCPatchThird Party AdvisoryWEB
lists.debian.org/debian-lts-announce/2021/04/msg00022.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB
