https://bugzilla.redhat.com/show_bug.cgi?id=1591931
Bug ID: 1591931
Summary: CVE-2018-11040 springframework: cross-domain requests
via JSONP through AbstractJsonpResponseBodyAdvice
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: dchen(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it
Spring Framework, versions 5.0.x prior to 5.0.7, versions 4.3.x prior to
4.3.18, and older unsupported versions, allows web applications to enable
cross-domain requests via JSONP (JSON with Padding) through
AbstractJsonpResponseBodyAdvice for REST controllers, and
MappingJackson2JsonView for browser requests. Both are not enabled by default
in Spring Framework nor Spring Boot. However when MappingJackson2JsonView is
configured in an application, JSONP support is automatically ready to use
through the "jsonp" and "callback" JSONP parameters, enabling
cross-domain
requests.
References:
https://pivotal.io/security/cve-2018-11040
--
You are receiving this mail because:
You are on the CC list for the bug.