Skip to content

Product

pivotal software spring data rest vulnerabilities

4 published CVES affecting pivotal software spring data rest, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
2
High
2
Medium
0
Low
0
Unscored
0
CISA KEV
1

Latest pivotal software spring data rest CVEs

Newest publication first

  1. CVE-2018-1259 Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references

    Published
    HighCVSS 7.5 EPSS 4.9%

    Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does no...

  3. CVE-2018-1273 Spring Data Commons remote code injection vulnerability

    Published
    CriticalCVSS 9.8 EPSS 97.0% CISA KEV added 2022-03-25 Ransomware Exploited in the wild PoC

    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted...

  4. CVE-2017-8046 Remote code execution in PATCH requests in Spring Data REST

    Published
    CriticalCVSS 9.8 EPSS 74.5% Public exploit

    Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.