CVE-2018-11040: Debian Linux

High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days.

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

Affected products

Debian Debian Linux: version 9.0 only
Oracle Agile Product Lifecycle Management: version 9.3.3 only; version 9.3.4 only; version 9.3.5 only
Oracle Application Testing Suite: version 12.5.0.3 only; version 13.1.0.1 only; version 13.2.0.1 only; version 13.3.0.1 only
Oracle Communications Network Integrity: from 7.3.2, up to and including 7.3.6
Oracle Communications Online Mediation Controller: version 6.1 only
Oracle Communications Services Gatekeeper: before 6.1.0.4.0 (fixed in 6.1.0.4.0)
Oracle Communications Unified Inventory Management: version 7.3.2 only; version 7.3.4 only; version 7.3.5 only; version 7.4.0 only
Oracle Endeca Information Discovery Integrator: version 3.1.0 only; version 3.2.0 only
Oracle Enterprise Manager: version 13.2 only
Oracle Enterprise Manager Ops Center: version 12.3.3 only
Oracle Flexcube Private Banking: version 2.0.0.0 only; version 2.2.0.1 only; version 12.0.1.0 only; version 12.0.3.0 only; version 12.1.0.0 only
Oracle Healthcare Master Person Index: version 3.0 only; version 4.0 only
Oracle Hospitality Guest Access: version 4.2.0 only; version 4.2.1 only
Oracle Insurance Calculation Engine: from 11.0.0, up to and including 11.3.1
Oracle Insurance Rules Palette: version 10.0 only; version 10.2 only
Oracle Micros Lucas: version 2.9.5 only
Oracle MySQL Enterprise Monitor: up to and including 3.4.9.4237; from 3.4.10, up to and including 4.0.6.5281; from 4.0.7, up to and including 8.0.2.8191
Oracle Product Lifecycle Management: version 9.3.6 only
Oracle Retail Advanced Inventory Planning: version 15.0 only
Oracle Retail Clearance Optimization Engine: version 14.0.5 only
Oracle Retail Customer Insights: version 15.0 only; version 16.0 only
Oracle Retail Markdown Optimization: version 13.4.4 only
Oracle Retail Predictive Application Server: version 14.0.3.26 only; version 14.1.3.37 only; version 15.0.3.100 only; version 16.0 only
Oracle Retail Service Backbone: version 16.0.1 only
Oracle Retail Xstore Point Of Service: version 7.1 only
and 3 more

Published 2018-06-25. Last modified 2026-10-08.