https://bugzilla.redhat.com/show_bug.cgi?id=1591929
Bug ID: 1591929
Summary: CVE-2018-11039 springframework: Cross Site Tracing
(XST) if vulnerable to XSS
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: dchen(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to
4.3.18, and older unsupported versions) allow web applications to change the
HTTP request method to any HTTP method (including TRACE) using the
HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS
vulnerability, a malicious user (or attacker) can use this filter to escalate
to an XST (Cross Site Tracing) attack.
References:
https://pivotal.io/security/cve-2018-11039
--
You are receiving this mail because:
You are on the CC list for the bug.