How severe is CVE-2018-1273?

CVE-2018-1273 has a CVSS 3.1 base score of 9.8 (CRITICAL). EPSS estimates a 97.0% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2018-1273: VMware Tanzu Spring Data Commons Property Binder

CISA Known Exploited Vulnerabilities

VMware Tanzu Spring Data Commons Property Binder Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2022-03-25

Remediation due

2022-04-15

Ransomware

Known use

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2018-1273

Description

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Severity

CVSS 3.1 · CISA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
Spring by Pivotal	Spring Framework	Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions

References

3 Links

Mailing lists

[ignite-dev] 20180719 [CVE-2018-1273] Apache Ignite impacted by security vulnerability in Spring Data Commons

Other references

Record Details

Published

2018-04-11

Last updated

2026-08-26

Assigner (CNA)

dell

Credited to

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-94 · Code Injection

Application Security Tools Penetration Testing Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.