← CVE Radar
CVE-2018-1273VMware Tanzu Spring Data Commons Property Binder Vulnerability
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
9.8 CRITICALEPSS 96.95%⚡ Known Exploited (CISA KEV)NVD: Published
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1CISA-ADP | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2018-1273
- Status
- Published
- Assigner (CNA)
- dell
- Published
- Apr 11, 2018
- Last modified
- 2026-08-26 03:56 UTC
- Weaknesses
- CWE-94 · Code Injection
Affected Products
As published by the CNA in the CVE record.
Spring by PivotalSpring Framework1 version range
- Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions
References
Sources
- NVD (unavailable at last refresh)
- CVE.org
- CISA KEV
- FIRST EPSS