CVE-2018-1273
Spring Data Commons remote code injection vulnerability
CVE-2018-1273 is a critical vulnerability (CVSS 9.8) in Broadcom Spring Data Commons, published April 11, 2018. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.0%, the 99th percentile. Fixed in org.springframework.data:spring-data-commons 1.13.11.
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
- Record
CVE-2018-1273- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
- Record
CVE-2018-1273- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2018-0500
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
- Record
EUVD-2018-0500- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4fq3-mr56-cg6r
Spring Data Commons remote code injection vulnerability
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding that can lead to a remote code execution attack.
- Record
GHSA-4fq3-mr56-cg6r- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
CISA KEV No score
VMware Tanzu Spring Data Commons Property Binder Vulnerability
Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.
- Record
CVE-2018-1273- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
- Record
CVE-2018-1273- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-4fq3-mr56-cg6r
Spring Data Commons remote code injection vulnerability
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding that can lead to a remote code execution attack.
- Record
GHSA-4fq3-mr56-cg6r- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-commonsMaven |
1.13.0 up to 1.13.11 | 1.13.11 |
org.springframework.data:spring-data-commonsMaven |
2.0.0 up to 2.0.6 | 2.0.6 |
org.springframework.data:spring-data-commonsMaven |
1.13.0 up to 1.13.11, plus listed versions 1.13.0.RELEASE1.13.1.RELEASE1.13.10.RELEASE1.13.2.RELEASE1.13.3.RELEASE Show 6 moreShow less1.13.4.RELEASE1.13.5.RELEASE1.13.6.RELEASE1.13.7.RELEASE1.13.8.RELEASE1.13.9.RELEASE |
1.13.11 |
org.springframework.data:spring-data-commonsMaven |
2.0.0 up to 2.0.6, plus listed versions 2.0.0.RELEASE2.0.1.RELEASE2.0.2.RELEASE2.0.3.RELEASE2.0.4.RELEASE2.0.5.RELEASE |
2.0.6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | knqyf263/CVE-2018-1273 | 2018-04-13 |
| PoC in GitHub | wearearima/poc-cve-2018-1273 | 2018-04-17 |
| PoC in GitHub | webr0ck/poc-cve-2018-1273 | 2018-10-05 |
| PoC in GitHub | cved-sources/cve-2018-1273 | 2019-01-17 |
| PoC in GitHub | jas502n/cve-2018-1273 | 2019-04-29 |
| PoC in GitHub | hdgokani/CVE-2018-1273 | 2025-06-25 |
| PoC in GitHub | CyberCTF/vulhub-spring-cve-2018-1273 | 2026-10-08 |
| Nuclei | Spring Data Commons - Remote Code Execution |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | exploitation, exploits | |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub |
References
mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E
oracle.com/security-alerts/cpujul2022.html
pivotal.io/security/cve-2018-1273
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1273
nvd.nist.gov/vuln/detail/CVE-2018-1273
github.com/advisories/GHSA-4fq3-mr56-cg6r