{"action":"Upgrade org.springframework:spring-web to 4.3.18 (4.x) or 5.0.7 (5.x) or later.","affected":[{"fixed":"5.0.7","introduced":"5.0.0"},{"fixed":"4.3.18","introduced":"4.3.0"}],"component":"org.springframework:spring-web","cve_ids":["CVE-2018-11039"],"ecosystem":"Maven","epss":0.02769,"exploited":false,"fixed_versions":["5.0.7","4.3.18"],"ghsa_id":"GHSA-9gcm-f4x3-8jpw","id":"tcs_01M5N8PZEWAF8X9DSC1ZXZT8CF","modified_at":"2024-12-02T05:43:15.118408Z","published_at":"2018-10-16T17:35:54Z","references":["https://osv.dev/vulnerability/GHSA-9gcm-f4x3-8jpw","https://nvd.nist.gov/vuln/detail/CVE-2018-11039","https://github.com/spring-projects/spring-framework/issues/21376","https://github.com/spring-projects/spring-framework/commit/323ccf99e575343f63d56e229c25c35c170b7ec1","https://github.com/spring-projects/spring-framework/commit/a5cd01a4c857aaaba7ccc51545fc73dd25b5cba5","https://github.com/spring-projects/spring-framework/commit/dac97f1b7dac3e70ff603fb6fc9f205b95dd6b01","https://github.com/spring-projects/spring-framework/commit/f2694a8ed93f1f63f87ce45d0bb638478b426acd","https://github.com/spring-projects/spring-framework/commit/f64fa3dea10af125d612d3a997aece93d21bc875","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://spring.io/security/cve-2018-11039","https://pivotal.io/security/cve-2018-11039","https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html","https://github.com/spring-projects/spring-framework","https://github.com/advisories/GHSA-9gcm-f4x3-8jpw","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/107984"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-9gcm-f4x3-8jpw","url":"https://osv.dev/vulnerability/GHSA-9gcm-f4x3-8jpw"}],"summary":"Spring Framework Cross Site Tracing (XST)"}