GitHub Advisoryadvisory · Maven

GHSA-4fq3-mr56-cg6r Spring Data Commons remote code injection vulnerability

CRITICAL Published 2018-10-17 Modified 2024-03-20 Official page ↗
Aliases
CVE-2018-1273
Ecosystem
Maven
Packages
org.springframework.data:spring-data-commons
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-94
Reviewed
2020-06-16

Affected packages

• Maven org.springframework.data:spring-data-commons: >= 1.13.0, < 1.13.11 → fixed in 1.13.11 • Maven org.springframework.data:spring-data-commons: >= 2.0.0, < 2.0.6 → fixed in 2.0.6

Description

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding that can lead to a remote code execution attack.

Related

Alias · CVE (1)

  • CVE-2018-1273 Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-94 Improper Control of Generation of Code weakness

References