VMware Tanzu · Spring Data Commons
The flaw is a property binder vulnerability in VMware Tanzu's Spring Data Commons component, caused by improper neutralization of special elements. An unauthenticated remote attacker can exploit it by sending specially crafted request parameters to Spring Data REST-backed HTTP resources or through Spring Data's projection-based request payload binding, leading to remote code execution; no user interaction or specific configuration is noted, and the affected versions are those prior to 1.13.10 and 2.0.5 (with older unsupported versions also affected).
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
First seen exploited 9 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 2 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Unauthenticated remote HTTP request exploits public-facing application
An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources
Successful exploitation yields remote code execution
can lead to a remote code execution attack
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: org.springframework.data:spring-data-commons.
Upgrade to 2.0.6 or later
Set the version to 2.0.6 or later in your pom.xml or build.gradle.
The first fix for CVE-2018-1273. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 2.0.0 up to 2.0.6 | 2.0.6 |
| 1.13.0 up to 1.13.11 | 1.13.11 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.