CVEvulnerability

CVE-2018-1273

9.8 CRITICAL Known exploited Published 2018-04-11 Modified 2026-08-26 Official page ↗

CISA Known Exploited Vulnerability

VMware Tanzu Spring Data Commons Property Binder Vulnerability — VMware Tanzu Spring Data Commons

Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.

Added to KEV: 2022-03-25
Remediation due: 2022-04-15
Ransomware use: Known
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2018-1273

Status: Analyzed
Published: 2018-04-11
Last modified: 2026-08-26
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses: CWE-94

Description

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Affected configurations

• broadcom spring data commons (<= 1.12.10) • broadcom spring data commons (>= 1.13.0 <= 1.13.10) • broadcom spring data commons (>= 2.0.0 <= 2.0.5) • pivotal software spring data rest (>= 3.0.0 <= 3.0.5) • vmware spring data rest (<= 2.5.10) • vmware spring data rest (>= 2.6.0 <= 2.6.10) • apache ignite (>= 1.0.1 <= 2.5.0) • apache ignite 1.0.0 • oracle financial services crime and compliance management studio 8.0.8.2.0 • oracle financial services crime and compliance management studio 8.0.8.3.0

Weakness · CWE (1)

CWE-94 Improper Control of Generation of Code weakness

References