GitHub Advisoryadvisory · Maven

GHSA-5q8m-mqmx-pxp9 Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation

HIGH Published 2018-10-17 Modified 2024-03-04 Official page ↗
Aliases
CVE-2018-1274
Ecosystem
Maven
Packages
org.springframework.data:spring-data-commons
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2020-06-16

Affected packages

• Maven org.springframework.data:spring-data-commons: < 1.13.11 → fixed in 1.13.11 • Maven org.springframework.data:spring-data-commons: >= 2.0.0, < 2.0.6 → fixed in 2.0.6

Description

Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).

Related

Alias · CVE (1)

  • CVE-2018-1274 Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References