Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2018-1273: VMware Tanzu Spring Data Commons lets attacker run code
CVE-2018-1273 · published 8 years ago · actively exploited
Summary
The Spring Data Commons library used in VMware Tanzu and related Spring applications can be tricked into executing code from an attacker. This could let an external party run unwanted programs on your servers. Apply the latest security updates or patches for the affected libraries as soon as possible.
What to do
- Update springframework org.springframework.data:spring-data-commons to version 1.13.11.
- Update springframework org.springframework.data:spring-data-commons to version 2.0.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | vmware tanzu | spring data commons | All versions |
| maven | springframework | org.springframework.data:spring-data-commons |
>= 1.13.0, < 1.13.11 >= 2.0.0, < 2.0.6 Fix: upgrade to 1.13.11
|
| – | pivotal_software | spring_data_commons |
<= 1.12.10 >= 1.13.0, <= 1.13.10 >= 2.0.0, <= 2.0.5 cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:* |
| – | pivotal_software | spring_data_rest |
<= 2.5.10 >= 2.6.0, <= 2.6.10 >= 3.0.0, <= 3.0.5 cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:* |
| – | apache | ignite |
>= 1.0.1, <= 2.5.0 1.0.0 cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:* |
| – | oracle | financial_services_crime_and_compliance_management_studio |
8.0.8.2.0 8.0.8.3.0 cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* |
| – | broadcom | spring_data_commons |
<= 1.12.10 >= 1.13.0, <= 1.13.10 >= 2.0.0, <= 2.0.5 cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* |
| – | vmware | spring_data_rest |
<= 2.5.10 >= 2.6.0, <= 2.6.10 cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:* |
| – | spring by pivotal | spring framework | Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions |
Original advisory text
VMware Tanzu Spring Data Commons Property Binder Vulnerability
Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-1273
- https://github.com/advisories/GHSA-4fq3-mr56-cg6r
- https://github.com/spring-projects/spring-data-commons/issues/1721
- https://github.com/spring-projects/spring-data-commons/commit/ae1dd2741ce06d44a0...
- https://github.com/spring-projects/spring-data-commons/commit/b1a20ae1e82a63f99b...
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-... URL
- https://www.oracle.com/security-alerts/cpujul2022.html Patch
- http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmC... Vendor Advisory
- https://pivotal.io/security/cve-2018-1273 Vendor Advisory
Internet-facing
3 days
and check for signs of compromise
Internal
3 days
and check for signs of compromise
- Known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
97%
chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-94Code Injection
Timeline
Published11 Apr 2018
Updated20 Oct 2026
First seen6 Mar 2026
Sources
CVE-2018-1273 · CISA KEV
CVE-2018-1273 · NVD
GHSA-4fq3-mr56-cg6r · GHSA
CVE-2018-1273 · OSV
CVE-2018-1273 · MITRE
Track software like this
Free during beta