CVE:CVE-2018-11040
CNNVD:CNNVD-201806-1190
Pivotal Spring Framework是美国Pivotal Software公司的一套开源的Java、Java EE应用程序框架。该框架可帮助开发人员构建高质量的应用。
Pivotal Spring Framework 5.0.7之前的5.0.x版本、4.3.18之前的4.3.x版本和不再支持的更早版本中存在安全漏洞，该漏洞源于程序允许Web应用程序通过JSONP打开跨域的请求。攻击者可利用该漏洞将用户信息泄露到第三方浏览器脚本。
solution:Upgrade vmware spring_framework to a higher version than 4.3.18,5.0.7,and avoid the version (,4.3.18),[5.0.0,5.0.7); Upgrade oracle agile_product_lifecycle_management to a higher version than 9.3.3,9.3.4,9.3.5,and avoid the version 9.3.3,9.3.4,9.3.5; Upgrade oracle application_testing_suite to a higher version than 12.5.0.3,13.1.0.1,13.2.0.1,13.3.0.1,and avoid the version 12.5.0.3,13.1.0.1,13.2.0.1,13.3.0.1; Upgrade oracle communications_network_integrity to a higher version than 7.3.6,and avoid the version [7.3.2,7.3.6]; Upgrade oracle communications_online_mediation_controller to a higher version than 6.1,and avoid the version 6.1; Upgrade oracle communications_services_gatekeeper to a higher version than 6.1.0.4.0,and avoid the version (,6.1.0.4.0); Upgrade oracle communications_unified_inventory_management to a higher version than 7.3.2,7.3.4,7.3.5,7.4.0,and avoid the version 7.3.2,7.3.4,7.3.5,7.4.0; Upgrade oracle endeca_information_discovery_integrator to a higher version than 3.1.0,3.2.0,and avoid the version 3.1.0,3.2.0; Upgrade oracle enterprise_manager to a higher version than 13.2,and avoid the version 13.2; Upgrade oracle enterprise_manager_ops_center to a higher version than 12.3.3,and avoid the version 12.3.3; Upgrade oracle flexcube_private_banking to a higher version than 2.0.0.0,2.2.0.1,12.0.1.0,12.0.3.0,12.1.0.0,and avoid the version 2.0.0.0,2.2.0.1,12.0.1.0,12.0.3.0,12.1.0.0; Upgrade oracle healthcare_master_person_index to a higher version than 3.0,4.0,and avoid the version 3.0,4.0; Upgrade oracle hospitality_guest_access to a higher version than 4.2.0,4.2.1,and avoid the version 4.2.0,4.2.1; Upgrade oracle insurance_calculation_engine to a higher version than 11.3.1,and avoid the version [11.0.0,11.3.1]; Upgrade oracle insurance_rules_palette to a higher version than 10.0,10.2,and avoid the version 10.0,10.2; Upgrade oracle micros_lucas to a higher version than 2.9.5,and avoid the version 2.9.5; Upgrade oracle mysql_enterprise_monitor to a higher version than 3.4.9.4237,4.0.6.5281,8.0.2.8191,and avoid the version (,3.4.9.4237],[3.4.10,4.0.6.5281],[4.0.7,8.0.2.8191]; Upgrade oracle product_lifecycle_management to a higher version than 9.3.6,and avoid the version 9.3.6; Upgrade oracle retail_advanced_inventory_planning to a higher version than 15.0,and avoid the version 15.0; Upgrade oracle retail_clearance_optimization_engine to a higher version than 14.0.5,and avoid the version 14.0.5; Upgrade oracle retail_customer_insights to a higher version than 15.0,16.0,and avoid the version 15.0,16.0; Upgrade oracle retail_markdown_optimization to a higher version than 13.4.4,and avoid the version 13.4.4; Upgrade oracle retail_predictive_application_server to a higher version than 14.0.3.26,14.1.3.37,15.0.3.100,16.0,and avoid the version 14.0.3.26,14.1.3.37,15.0.3.100,16.0; Upgrade oracle retail_service_backbone to a higher version than 16.0.1,and avoid the version 16.0.1; Upgrade oracle retail_xstore_point_of_service to a higher version than 7.1,and avoid the version 7.1; Upgrade oracle utilities_network_management_system to a higher version than 1.12.0.3,and avoid the version 1.12.0.3; Upgrade oracle weblogic_server to a higher version than 12.2.1.3.0,and avoid the version 12.2.1.3.0; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0