# CVE-2018-1273

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

- Page: https://www.vulneraibility.com/cve/CVE-2018-1273
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-03-25; CISA due date 2022-04-15; known ransomware use
- EPSS: 96.96% (percentile 99.9)
- Unvetted proof-of-concept code on GitHub: 7 GitHub proofs of concept · 1 Nuclei template (first 2018-04-13)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2022-03-11)
- Weakness: CWE-94
- Published: 2018-04-11

## Affected versions

- Spring by Pivotal Spring Framework: affected Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E
- [other] https://www.oracle.com/security-alerts/cpujul2022.html
- [other] https://pivotal.io/security/cve-2018-1273
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1273

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.