VULNERABILITY INTELLIGENCE

CVE-2018-1273

CVSS score9.8 CRITICAL
EPSS probability96.96%
CISA KEVKnown exploited vulnerability
Published2018-04-11
Last modified2026-08-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

VMware Tanzu Spring Data Commons Property Binder Vulnerability

Vendor / product: VMware Tanzu / Spring Data Commons

Description

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references