cve.bz

CVE-2018-1273

9.8 criticalKEVEPSS 97%

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
97% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV
listed 2022-03-25, due 2022-04-15, known ransomware use
CWE
CWE-94
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4fq3-mr56-cg6rMavenorg.springframework.data:spring-data-commons>=1.13.0 <1.13.111.13.11
GHSA-4fq3-mr56-cg6rMavenorg.springframework.data:spring-data-commons>=2.0.0 <2.0.62.0.6

References

Check your stackJSON