by Kastro
Paper/Archive/CVE-2018-1273

CVE-2018-1273

Spring by Pivotal Spring Framework — VMware Tanzu Spring Data Commons Property Binder Vulnerability

KEV · due 15 Aprransomware useEPSS 97%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Affected

ProductAffectedFixed inSource
Spring FrameworkVersions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refmail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3Ereforacle.com/security-alerts/cpujul2022.htmlrefpivotal.io/security/cve-2018-1273refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1273kevcisa.gov/known-exploited-vulnerabilities-catalog