{"id":"CVE-2018-1273","aliases":["EUVD-2018-0500","GHSA-4fq3-mr56-cg6r"],"status":"published","title":"Spring Data Commons remote code injection vulnerability","description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.96956,"percentile":0.99889,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-94"],"published":"2018-04-11T13:00:00Z","modified":"2026-10-24T10:30:30Z","kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-03-25"},{"source":"kev","since":"2022-03-25"}],"exploits":[{"source":"pocgithub","id":"knqyf263/CVE-2018-1273","title":"knqyf263/CVE-2018-1273","date":"2018-04-13","url":"https://github.com/knqyf263/CVE-2018-1273"},{"source":"pocgithub","id":"wearearima/poc-cve-2018-1273","title":"wearearima/poc-cve-2018-1273","date":"2018-04-17","url":"https://github.com/wearearima/poc-cve-2018-1273"},{"source":"pocgithub","id":"webr0ck/poc-cve-2018-1273","title":"webr0ck/poc-cve-2018-1273","date":"2018-10-05","url":"https://github.com/webr0ck/poc-cve-2018-1273"},{"source":"pocgithub","id":"cved-sources/cve-2018-1273","title":"cved-sources/cve-2018-1273","date":"2019-01-17","url":"https://github.com/cved-sources/cve-2018-1273"},{"source":"pocgithub","id":"jas502n/cve-2018-1273","title":"jas502n/cve-2018-1273","date":"2019-04-29","url":"https://github.com/jas502n/cve-2018-1273"},{"source":"pocgithub","id":"hdgokani/CVE-2018-1273","title":"hdgokani/CVE-2018-1273","date":"2025-06-25","url":"https://github.com/hdgokani/CVE-2018-1273"},{"source":"pocgithub","id":"CyberCTF/vulhub-spring-cve-2018-1273","title":"CyberCTF/vulhub-spring-cve-2018-1273","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-spring-cve-2018-1273"},{"source":"nuclei","id":"CVE-2018-1273","title":"Spring Data Commons - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1273.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","fixed_in":["1.13.11","2.0.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.11"}]}],"versions":["1.13.0.RELEASE","1.13.1.RELEASE","1.13.10.RELEASE","1.13.2.RELEASE","1.13.3.RELEASE","1.13.4.RELEASE","1.13.5.RELEASE","1.13.6.RELEASE","1.13.7.RELEASE","1.13.8.RELEASE","1.13.9.RELEASE"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.6"}]}],"versions":["2.0.0.RELEASE","2.0.1.RELEASE","2.0.2.RELEASE","2.0.3.RELEASE","2.0.4.RELEASE","2.0.5.RELEASE"]}],"products":[{"vendor":"apache","product":"ignite"},{"vendor":"broadcom","product":"spring_data_commons"},{"vendor":"oracle","product":"financial_services_crime_and_compliance_management_studio"},{"vendor":"pivotal_software","product":"spring_data_rest"},{"vendor":"spring by pivotal","product":"spring framework"},{"vendor":"vmware","product":"spring framework"},{"vendor":"vmware","product":"spring_data_rest"},{"vendor":"vmware tanzu","product":"spring data commons"}],"references":[{"url":"http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://pivotal.io/security/cve-2018-1273","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1273","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1273","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4fq3-mr56-cg6r","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-data-commons/issues/1721","tags":["web"]},{"url":"https://github.com/spring-projects/spring-data-commons/commit/ae1dd2741ce06d44a0966ecbd6f47beabde2b653","tags":["web"]},{"url":"https://github.com/spring-projects/spring-data-commons/commit/b1a20ae1e82a63f99b3afc6f2aaedb3bf4dc432a","tags":["web"]},{"url":"https://github.com/spring-projects/spring-data-commons","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-1273","description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.","status":"published","published":"2018-04-11T13:00:00Z","modified":"2026-08-26T03:56:07.777Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:09.139955Z"}],"euvd":[{"id":"EUVD-2018-0500","description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.","status":"published","published":"2018-04-11T13:00:00Z","modified":"2026-08-26T03:56:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-03-25","updated_at":"2026-11-02T18:01:31.718552Z"}],"ghsa":[{"id":"GHSA-4fq3-mr56-cg6r","title":"Spring Data Commons remote code injection vulnerability","description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding that can lead to a remote code execution attack.","status":"published","published":"2018-10-17T17:23:24Z","modified":"2024-03-20T14:20:44Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-94"],"updated_at":"2026-11-02T14:37:41.821668Z"}],"kev":[{"id":"CVE-2018-1273","title":"VMware Tanzu Spring Data Commons Property Binder Vulnerability","description":"Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.","cwes":["CWE-94"],"kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2018-1273","description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.","status":"published","published":"2018-04-11T13:29:00.29Z","modified":"2026-08-26T05:18:03.1Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:04:25.506659Z"}],"osv":[{"id":"CVE-2018-1273","description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.","status":"published","published":"2018-04-11T13:29:00.29Z","modified":"2026-10-24T10:30:30.602521084Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"GHSA-4fq3-mr56-cg6r","title":"Spring Data Commons remote code injection vulnerability","description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding that can lead to a remote code execution attack.","status":"published","published":"2018-10-17T17:23:24Z","modified":"2024-03-20T14:42:58.298208Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-94"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}