Skip to content
Fencer Intel
critical 9.8

CVE-2018-1273 kev+ ransomware in the critical feed json

Spring Data Commons remote code injection vulnerability

published 2018-04-11 8 y ago modified 2026-08-26 2 mo ago also GHSA-4fq3-mr56-cg6r , EUVD-2018-0500

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2022-03-25, used in ransomware
epss
97.0%
EPSS 97.0% chance of exploitation in 30 days, percentile 99.8%
public exploits
0
none known, plus a Nuclei check

Summary

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • maven org.springframework.data:spring-data-commons 1.13.11, 2.0.6

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1273 updated cvss 9.8

spring-data-commons: Improper neutralization of special elements allow remote attackers to execute code via crafted requests

  • Red Hat Fuse 7 spring-data-commons
    affected: no fix available
  • Red Hat JBoss Fuse 6 spring-data-commons Red Hat JBoss Fuse Integration Service 2 spring-data-commons Red Hat Mobile Application Platform 4 spring-data-commons
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. CISA SSVC: exploitation active
  3. Added to CISA KEV
  4. CISA patch deadline

Known exploited

Added
4 y ago
Patch by
2022-04-15 (4 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor, product
VMware Tanzu, Spring Data Commons
CISA name
VMware Tanzu Spring Data Commons Property Binder Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
4 y ago

Exploit prediction

96.96% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Nuclei template Spring Data Commons - Remote Code Execution nuclei detection template

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.springframework.data:spring-data-commons
>=1.13.0, <1.13.11
>=2.0.0, <2.0.6
1.13.11
2.0.6

Affected products

  • Spring by Pivotal Spring Framework

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.