CVE-2018-11040: spring framework before 4.3.18 (exclusive), from 5.0.0 (inclusive), before 5.0.7 (exclusive); +28 more affected products

Affected technology

spring framework · before 4.3.18 (exclusive)
vmware

spring framework · from 5.0.0 (inclusive), before 5.0.7 (exclusive)
vmware

agile product lifecycle management · 9.3.3
oracle

agile product lifecycle management · 9.3.4
oracle

agile product lifecycle management · 9.3.5
oracle

application testing suite · 12.5.0.3
oracle

application testing suite · 13.1.0.1
oracle

application testing suite · 13.2.0.1
oracle

application testing suite · 13.3.0.1
oracle

communications network integrity · from 7.3.2 (inclusive), through 7.3.6 (inclusive)
oracle

communications online mediation controller · 6.1
oracle

communications services gatekeeper · before 6.1.0.4.0 (exclusive)
oracle

communications unified inventory management · 7.3.2
oracle

communications unified inventory management · 7.3.4
oracle

communications unified inventory management · 7.3.5
oracle

communications unified inventory management · 7.4.0
oracle

endeca information discovery integrator · 3.1.0
oracle

endeca information discovery integrator · 3.2.0
oracle

enterprise manager · 13.2
oracle

enterprise manager ops center · 12.3.3
oracle

flexcube private banking · 2.0.0.0
oracle

flexcube private banking · 2.2.0.1
oracle

flexcube private banking · 12.0.1.0
oracle

flexcube private banking · 12.0.3.0
oracle

flexcube private banking · 12.1.0.0
oracle

healthcare master person index · 3.0
oracle

healthcare master person index · 4.0
oracle

hospitality guest access · 4.2.0
oracle

hospitality guest access · 4.2.1
oracle

insurance calculation engine · from 11.0.0 (inclusive), through 11.3.1 (inclusive)
oracle

insurance rules palette · 10.0
oracle

insurance rules palette · 10.2
oracle

micros lucas · 2.9.5
oracle

mysql enterprise monitor · through 3.4.9.4237 (inclusive)
oracle

mysql enterprise monitor · from 3.4.10 (inclusive), through 4.0.6.5281 (inclusive)
oracle

mysql enterprise monitor · from 4.0.7 (inclusive), through 8.0.2.8191 (inclusive)
oracle

product lifecycle management · 9.3.6
oracle

retail advanced inventory planning · 15.0
oracle

retail clearance optimization engine · 14.0.5
oracle

retail customer insights · 15.0
oracle

retail customer insights · 16.0
oracle

retail markdown optimization · 13.4.4
oracle

retail predictive application server · 14.0.3.26
oracle

retail predictive application server · 14.1.3.37
oracle

retail predictive application server · 15.0.3.100
oracle

retail predictive application server · 16.0
oracle

retail service backbone · 16.0.1
oracle

retail xstore point of service · 7.1
oracle

utilities network management system · 1.12.0.3
oracle

weblogic server · 12.2.1.3.0
oracle

debian linux · 9.0
debian

Spring Framework · 5.0.x to before 5.0.7, 4.3.x to before 4.3.18
Pivotal

Description’s affected range: versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions,

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.