Moderate severity vulnerability that affects org.springframework:spring-core
Moderate severity
GitHub Reviewed
Published
Oct 16, 2018
to the GitHub Advisory Database
•
Updated May 15, 2024
Package
Affected versions
>= 5.0.0.RELEASE, < 5.0.7.RELEASE
>= 4.3.0.RELEASE, < 4.3.18.RELEASE
Patched versions
5.0.7.RELEASE
4.3.18.RELEASE
Description
Published by the National Vulnerability Database
Jun 25, 2018
Published to the GitHub Advisory Database
Oct 16, 2018
Reviewed
Jun 16, 2020
Last updated
May 15, 2024
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
References