UpHeron
All vulnerabilities

Servers and applications

CVE-2018-11040

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when…

Severity
High 7.5
Published
25 Jun 2018
Last changed
8 Oct 2026
Added to UpHeron
1 Nov 2026
Exploit chance
3.2% in the next 30 daysHigher than 88% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Oracle WebLogic ServerServers and applications · cpe:a:oracle:weblogic_server
  • Version 12.2.1.3.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-11040
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-11040