Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter …

{
                    "product": "Spring Framework",
                    "vendor": "Pivotal",
                    "versions": [
                        {
                            "lessThan": "5.0.7",
                            "status": "affected",
                            "version": "5.0.x",
                            "versionType": "custom"
                        },
                        {
                            "lessThan": "4.3.18",
                            "status": "affected",
                            "version": "4.3.x",
                            "versionType": "custom"
                        }
                    ]
                }