CVE-2018-1273 Spring Data Commons remote code injection vulnerability
CriticalCVSS 9.8
EPSS 97.0%
CISA KEV
added 2022-03-25 · due 2022-04-15
Ransomware
Exploited in the wild
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CISA Known Exploited Vulnerability
- Date added
- 2022-03-25
- Due date (FCEB)
- 2022-04-15
- Ransomware use
- Known
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework.data/spring-data-commons(Maven) | >= 1.13.0, < 1.13.11 | 1.13.11 |
| org.springframework.data/spring-data-commons(Maven) | = 1.13.0.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 1.13.1.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 1.13.10.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 1.13.2.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 1.13.3.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 1.13.4.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 1.13.5.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 1.13.6.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 1.13.7.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 1.13.8.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 1.13.9.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | >= 2.0.0, < 2.0.6 | 2.0.6 |
| org.springframework.data/spring-data-commons(Maven) | = 2.0.0.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 2.0.1.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 2.0.2.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 2.0.3.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 2.0.4.RELEASE | No fix listed |
| org.springframework.data/spring-data-commons(Maven) | = 2.0.5.RELEASE | No fix listed |
| Spring by Pivotal Spring Framework | = Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions | No fix listed |
| broadcom spring data commons | <= 1.12.10 | No fix listed |
| broadcom spring data commons | >= 1.13.0, <= 1.13.10 | No fix listed |
| broadcom spring data commons | >= 2.0.0, <= 2.0.5 | No fix listed |
| pivotal software spring data rest | >= 3.0.0, <= 3.0.5 | No fix listed |
| VMware spring data rest | <= 2.5.10 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware spring data rest | >= 2.6.0, <= 2.6.10 | No fix listed |
| apache ignite | >= 1.0.1, <= 2.5.0 | No fix listed |
| apache ignite | = 1.0.0 | No fix listed |
| apache ignite | = 1.0.0-rc3 | No fix listed |
| oracle financial services crime and compliance management studio | = 8.0.8.2.0 | No fix listed |
| oracle financial services crime and compliance management studio | = 8.0.8.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com patch
- github.com patch
- github.com vendor-advisory
- github.com product
- pivotal.io vendor-advisory
- www.oracle.com patch third-party-advisory
- [ignite-dev] 20180719 [CVE-2018-1273] Apache Ignite impacted by security vulnerability in Spring Data Commons mailing-list third-party-advisory
- www.cisa.gov government-resource us-government-resource