CVE-2018-1273 is a critical remote code execution (RCE) vulnerability in Spring Data Commons versions prior to 1.13.10 and 2.0.5, affecting products like Apache, Oracle, and Pivotal Software. This flaw allows unauthenticated attackers to execute arbitrary code by supplying specially crafted request parameters to Spring Data REST HTTP resources or using projection-based request payload binding. With a CVSS score of 9.8 (critical) and an EPSS score indicating high exploitability, the vulnerability poses a severe risk, enabling full compromise of confidentiality, integrity, and availability. It is actively exploited, including in known ransomware campaigns like Satan, and while no Metasploit or ExploitDB modules exist, community-developed exploit scripts and Nuclei templates are available, generating significant discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.12.10CPE matchmatch criteria | cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* | ||
>= 1.13.0, <= 1.13.10CPE matchmatch criteria | cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* | ||
>= 2.0.0, <= 2.0.5CPE matchmatch criteria | cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* | ||
>= 3.0.0, <= 3.0.5CPE matchmatch criteria | cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:* | ||
<= 2.5.10CPE matchmatch criteria | cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.