Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-1273

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Published

2018-04-11T13:29:00.290

Last Modified

2025-03-14T20:54:07.450

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-94
  • Type: Secondary
    NVD-CWE-Other
  • Type: Secondary
    CWE-74
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application pivotal_software spring_data_commons ≤ 1.12.10 Yes
Application pivotal_software spring_data_commons ≤ 1.13.10 Yes
Application pivotal_software spring_data_commons ≤ 2.0.5 Yes
Application pivotal_software spring_data_rest ≤ 2.5.10 Yes
Application pivotal_software spring_data_rest ≤ 2.6.10 Yes
Application pivotal_software spring_data_rest ≤ 3.0.5 Yes
Application apache ignite ≤ 2.5.0 Yes
Application apache ignite 1.0.0 Yes
Application apache ignite 1.0.0 Yes
Application oracle financial_services_crime_and_compliance_management_studio 8.0.8.2.0 Yes
Application oracle financial_services_crime_and_compliance_management_studio 8.0.8.3.0 Yes
References