cyfenced.com →

[ CVE-2018-1273 · Published 11 Apr 2018 ]

VMware Tanzu Spring Data Commons Property Binder Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 97%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-25
  • Known to be used in ransomware campaigns
  • EPSS: 97% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

CISA: Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Apr 2022): Apply updates per vendor instructions.

[ References ]References