Spring Framework Cross Site Tracing (XST)
Moderate severity
GitHub Reviewed
Published
Oct 16, 2018
to the GitHub Advisory Database
•
Updated Mar 5, 2024
Package
Affected versions
>= 5.0.0, < 5.0.7
>= 4.3.0, < 4.3.18
Patched versions
5.0.7
4.3.18
Description
Published by the National Vulnerability Database
Jun 25, 2018
Published to the GitHub Advisory Database
Oct 16, 2018
Reviewed
Jun 16, 2020
Last updated
Mar 5, 2024
Credits
-
sunSUNQ Analyst
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
References