Cross-Site Tracing (XST) Affecting org.springframework:spring-web package, versions [4.3.0.RELEASE, 4.3.18.RELEASE) [5.0.0.RELEASE, 5.0.7.RELEASE)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORK-451604
- published 25 Dec 2016
- disclosed 25 Dec 2016
- credit Mariusz Luciow
Introduced: 25 Dec 2016
CVE-2018-11039 Open this link in a new tabHow to fix?
Upgrade org.springframework:spring-web to version 4.3.18.RELEASE, 5.0.7.RELEASE or higher.
Overview
org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.
Affected versions of this package are vulnerable to Cross-Site Tracing (XST). It allows web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST attack.