⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-04-15.
CVE-2018-1273
Severity
9.8CRITICAL
EPSS
94.3%
top 0.06%
CISA KEV
KEVRansomware
Added 2022-03-25
Due 2022-04-15
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedApr 11
KEV addedMar 25
KEV dueApr 15
Latest updateJan 15
CISA Required Action: Apply updates per vendor instructions.
Description
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages6 packages
▶CVEListV5spring_by_pivotal/spring_frameworkVersions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions
Patches
🔴Vulnerability Details
4💥Exploits & PoCs
1Nuclei▶
Spring Data Commons - Remote Code Execution
📋Vendor Advisories
4💬Community
1Bugzilla▶
CVE-2018-1273 spring-data-commons: Improper neutralization of special elements allow remote attackers to execute code via crafted requests↗2018-04-11