CVE-2018-1273Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements.
Updated under an hour ago ()
Does this affect you?
It affects Spring by Pivotal Spring Framework and 5 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Mar 25, 2022; federal agencies had to remediate by Apr 15, 2022, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Free account, 1 product
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
- CVSS
- 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-94
- Known exploited
- Added to CISA KEV Mar 25, 2022; federal remediation due Apr 15, 2022; known ransomware useApply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 96.96% (percentile 100)
- Assigned by
- dell
- NVD analysis
- Analyzed
- Record last updated
- Aug 26, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Spring by Pivotal Spring Framework spring_by_pivotal:spring_framework (from the name) | Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions | CNA record |
broadcom spring_data_commons broadcom:spring_data_commons | through 1.12.10; from 1.13.0 through 1.13.10; from 2.0.0 through 2.0.5 | NVD |
pivotal_software spring_data_rest pivotal_software:spring_data_rest | from 3.0.0 through 3.0.5 | NVD |
vmware spring_data_rest vmware:spring_data_rest | through 2.5.10; from 2.6.0 through 2.6.10 | NVD |
apache ignite apache:ignite | from 1.0.1 through 2.5.0; 1.0.0; 1.0.0 | NVD |
oracle financial_services_crime_and_compliance_management_studio oracle:financial_services_crime_and_compliance_management_studio | 8.0.8.2.0; 8.0.8.3.0 | NVD |
References
- http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3Emailing-list, x-refsource-mlist, third-party-advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlx-refsource-misc, patch, third-party-advisory
- https://pivotal.io/security/cve-2018-1273x-refsource-confirm, vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1273us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.