{"schemaVersion":3,"id":"CVE-2018-1273","aliases":["GHSA-4fq3-mr56-cg6r"],"status":"published","duplicateOf":null,"title":"VMware Tanzu Spring Data Commons Property Binder Vulnerability","description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.","dates":{"published":"2018-04-11T13:00:00.000Z","modified":"2026-08-26T03:56:07.777Z","reserved":null,"kevAdded":["2022-03-25T00:00:00.000Z"],"kevDue":["2022-04-15T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Maven","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true}]},"epss":{"probability":0.96956,"percentile":0.99891,"severity":"critical","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":-0.046000000000001595,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.97002},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.97002,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.97002,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.97002,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.97002,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.97002,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.97002,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.96956,"percentile":0.99891}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.97002,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.97002,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.96956,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.96956,"percentile":0.99891}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-25T00:00:00.000Z","dueDate":"2022-04-15T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"VMware Tanzu Spring Data Commons Property Binder Vulnerability","description":"Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-1273","label":"nvd.nist.gov/vuln/detail/CVE-2018-1273"}],"vendor":"VMware Tanzu","product":"Spring Data Commons","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-03-25T00:00:00.000Z","dueDate":"2022-04-15T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"VMware Tanzu Spring Data Commons Property Binder Vulnerability","description":"Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-1273","label":"nvd.nist.gov/vuln/detail/CVE-2018-1273"}],"vendor":"VMware Tanzu","product":"Spring Data Commons","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/94.html"}],"affected":[{"vendor":"apache","product":"ignite","name":"ignite","label":"ignite","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.0.1, ≤ 2.5.0","noFixRecorded":false,"fixedIn":null},{"text":"1.0.0","noFixRecorded":false,"fixedIn":null},{"text":"1.0.0:rc3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.0.1, ≤ 2.5.0 | 1.0.0 | 1.0.0:rc3","eol":null,"hubHref":"/vendor/apache/ignite"},{"vendor":"broadcom","product":"spring_data_commons","name":"spring data commons","label":"spring_data_commons","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.12.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.13.0, ≤ 1.13.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.0.0, ≤ 2.0.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.12.10 | ≥ 1.13.0, ≤ 1.13.10 | ≥ 2.0.0, ≤ 2.0.5","eol":null,"hubHref":"/vendor/broadcom/spring_data_commons"},{"vendor":"org.springframework.data","product":"spring-data-commons","name":"org.springframework.data:spring-data-commons","label":"spring-data-commons","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.springframework.data/spring-data-commons","purlType":"maven","versions":[{"text":"≥ 1.13.0, < 1.13.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.0.0, < 2.0.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.13.0, < 1.13.11 | ≥ 2.0.0, < 2.0.6","eol":null,"hubHref":null},{"vendor":"oracle","product":"financial_services_crime_and_compliance_management_studio","name":"financial services crime and compliance management studio","label":"financial_services_crime_and_compliance_management_studio","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"8.0.8.2.0","noFixRecorded":false,"fixedIn":null},{"text":"8.0.8.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.0.8.2.0 | 8.0.8.3.0","eol":null,"hubHref":"/vendor/oracle/financial_services_crime_and_compliance_management_studio"},{"vendor":"pivotal_software","product":"spring_data_rest","name":"spring data rest","label":"spring_data_rest","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 3.0.0, ≤ 3.0.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 3.0.0, ≤ 3.0.5","eol":null,"hubHref":"/vendor/pivotal_software/spring_data_rest"},{"vendor":"spring by pivotal","product":"spring framework","name":"Spring Framework","label":"spring framework","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions","noFixRecorded":false,"fixedIn":null}],"versionsText":"Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions","eol":null,"hubHref":"/vendor/spring_by_pivotal/spring_framework"},{"vendor":"vmware","product":"spring_data_rest","name":"spring data rest","label":"spring_data_rest","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.5.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.6.0, ≤ 2.6.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.5.10 | ≥ 2.6.0, ≤ 2.6.10","eol":null,"hubHref":"/vendor/vmware/spring_data_rest"}],"affectedCount":7,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E","label":"mail-archives.apache.org/mod_mbox/…","hostname":"mail-archives.apache.org","tags":["Mailing List","X Refsource MLIST","Third Party Advisory","WEB"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"www.oracle.com/security-alerts/cpujul2022.html","hostname":"www.oracle.com","tags":["X Refsource MISC","Patch","Third Party Advisory","WEB"]},{"url":"https://pivotal.io/security/cve-2018-1273","label":"pivotal.io/security/cve-2018-1273","hostname":"pivotal.io","tags":["X Refsource CONFIRM","Vendor Advisory","WEB"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1273","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1273","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1273","label":"nvd.nist.gov/vuln/detail/CVE-2018-1273","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/spring-projects/spring-data-commons/issues/1721","label":"github.com/spring-projects/spring-data-commons/issues/1721","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/spring-projects/spring-data-commons/commit/ae1dd2741ce06d44a0966ecbd6f47beabde2b653","label":"github.com/spring-projects/spring-data-commons/commit/ae1dd2741ce06d44a0966ecbd6f47beabde2b653","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/spring-projects/spring-data-commons/commit/b1a20ae1e82a63f99b3afc6f2aaedb3bf4dc432a","label":"github.com/spring-projects/spring-data-commons/commit/b1a20ae1e82a63f99b3afc6f2aaedb3bf4dc432a","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/advisories/GHSA-4fq3-mr56-cg6r","label":"github.com/advisories/GHSA-4fq3-mr56-cg6r","hostname":"github.com","tags":["Advisory"]},{"url":"https://github.com/spring-projects/spring-data-commons","label":"github.com/spring-projects/spring-data-commons","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-04-11T13:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-03-25T00:00:00.000Z","label":"Added to CISA KEV","detail":"VMware Tanzu Spring Data Commons Property Binder Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-04-15T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-08-26T03:56:07.777Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T08:16:35.120Z","stale":false,"partial":false}}