CVE-2018-11040Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through…
Updated under an hour ago ()
Does this affect you?
It affects Pivotal Spring Framework and 28 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 3.23%, higher than 88% of scored CVEs.
Do this next
Free account, 1 product
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
- CVSS
- 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 3.23% (percentile 88)
- Assigned by
- dell
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Pivotal Spring Framework pivotal:spring_framework (from the name) | from 5.0.x before 5.0.7; from 4.3.x before 4.3.18 | CNA record |
vmware spring_framework vmware:spring_framework | before 4.3.18; from 5.0.0 before 5.0.7 | NVD |
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management | 9.3.3; 9.3.4; 9.3.5 | NVD |
oracle application_testing_suite oracle:application_testing_suite | 12.5.0.3; 13.1.0.1; 13.2.0.1; 13.3.0.1 | NVD |
oracle communications_network_integrity oracle:communications_network_integrity | from 7.3.2 through 7.3.6 | NVD |
oracle communications_online_mediation_controller oracle:communications_online_mediation_controller | 6.1 | NVD |
oracle communications_services_gatekeeper oracle:communications_services_gatekeeper | before 6.1.0.4.0 | NVD |
oracle communications_unified_inventory_management oracle:communications_unified_inventory_management | 7.3.2; 7.3.4; 7.3.5; 7.4.0 | NVD |
oracle endeca_information_discovery_integrator oracle:endeca_information_discovery_integrator | 3.1.0; 3.2.0 | NVD |
oracle enterprise_manager oracle:enterprise_manager | 13.2 | NVD |
oracle enterprise_manager_ops_center oracle:enterprise_manager_ops_center | 12.3.3 | NVD |
oracle flexcube_private_banking oracle:flexcube_private_banking | 2.0.0.0; 2.2.0.1; 12.0.1.0; 12.0.3.0; 12.1.0.0 | NVD |
oracle healthcare_master_person_index oracle:healthcare_master_person_index | 3.0; 4.0 | NVD |
oracle hospitality_guest_access oracle:hospitality_guest_access | 4.2.0; 4.2.1 | NVD |
oracle insurance_calculation_engine oracle:insurance_calculation_engine | from 11.0.0 through 11.3.1 | NVD |
oracle insurance_rules_palette oracle:insurance_rules_palette | 10.0; 10.2 | NVD |
oracle micros_lucas oracle:micros_lucas | 2.9.5 | NVD |
oracle mysql_enterprise_monitor oracle:mysql_enterprise_monitor | through 3.4.9.4237; from 3.4.10 through 4.0.6.5281; from 4.0.7 through 8.0.2.8191 | NVD |
oracle product_lifecycle_management oracle:product_lifecycle_management | 9.3.6 | NVD |
oracle retail_advanced_inventory_planning oracle:retail_advanced_inventory_planning | 15.0 | NVD |
oracle retail_clearance_optimization_engine oracle:retail_clearance_optimization_engine | 14.0.5 | NVD |
oracle retail_customer_insights oracle:retail_customer_insights | 15.0; 16.0 | NVD |
oracle retail_markdown_optimization oracle:retail_markdown_optimization | 13.4.4 | NVD |
oracle retail_predictive_application_server oracle:retail_predictive_application_server | 14.0.3.26; 14.1.3.37; 15.0.3.100; 16.0 | NVD |
oracle retail_service_backbone oracle:retail_service_backbone | 16.0.1 | NVD |
oracle retail_xstore_point_of_service oracle:retail_xstore_point_of_service | 7.1 | NVD |
oracle utilities_network_management_system oracle:utilities_network_management_system | 1.12.0.3 | NVD |
oracle weblogic_server oracle:weblogic_server | 12.2.1.3.0 | NVD |
debian debian_linux debian:debian_linux | 9.0 | NVD |
References
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlx-refsource-confirm, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlx-refsource-confirm, patch, third-party-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpujan2020.htmlx-refsource-misc, patch, third-party-advisory
- https://pivotal.io/security/cve-2018-11040x-refsource-confirm, mitigation, vendor-advisory
- https://lists.debian.org/debian-lts-announce/2021/04/msg00022.htmlmailing-list, x-refsource-mlist, third-party-advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlx-refsource-misc, patch, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.