Cross-site request forgery In org.springframework:spring-web
Description
Spring Framework Cross Site Tracing (XST) Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 5.0.7, 4.3.18 | ||
maven | - | ||
 debian 11 | 4.3.19-1 | ||
debian 13 | 4.3.19-1 | ||
debian 14 | 4.3.19-1 | ||
debian 12 | 4.3.19-1 | ||
maven | - |
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16.