Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-04-15. Apply updates per vendor instructions.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 4 products
🚨 CRITICAL: CVE-2018-1273 | CVSS 9.8 Spring Data Commons RCE via property binder flaw. Unauthenticated remote code execution possible. Affected: versions <1.13.10, 2.0-2.0.5 Patch immediately! #CVE #Vulnerability #PatchNow https://t.co/OSs5BQeONg
Post summary
The tweet alerts users to a critical CVE‑2018‑1273 that allows unauthenticated remote code execution in Spring Data Commons and urges immediate patching.
8 of 8 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | ignite | - | - | - |
| App | apache | ignite | 1.0.0 | - | - |
| App | apache | ignite | 1.0.0 | - | - |
| App | broadcom | spring_data_commons | - | - | - |
| App | oracle | financial_services_crime_and_compliance_management_studio | 8.0.8.2.0 | - | - |
| App | oracle | financial_services_crime_and_compliance_management_studio | 8.0.8.3.0 | - | - |
| App | pivotal_software | spring_data_rest | - | - | - |
| App | vmware | spring_data_rest | - | - | - |