ZeroDay Findings
Sign inSign up

Findings

CVE-2018-1273

VMware Tanzu Spring Data Commons Property Binder Vulnerability

Published Apr 11, 2018 · updated Aug 25, 2026 · broadcom spring data commons

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 11, 2018 · Catalog

    Detected

    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request paylo

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Aug 25, 2026 · Catalog

    Updated

    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request paylo

Required action

Apply updates per vendor instructions.

CISA due date Apr 15, 2022

Affected

  • cpe apache/igniteversion unspecified
  • cpe apache/ignite1.0.0
  • cpe broadcom/spring data commonsversion unspecified
  • cpe oracle/financial services crime and compliance management studio8.0.8.2.0
  • cpe pivotal software/spring data restversion unspecified
  • cpe vmware/spring data restversion unspecified
  • vendor VMware Tanzu Spring Data Commonsversion unspecified

Sources

  • CISA KEVCVE-2018-1273

    Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.

    cisa.gov
  • CVE.orgCVE-2018-1273

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-1273

    30-day exploitation probability 97.0%

    first.org
  • NIST NVDCVE-2018-1273

    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted

    nvd.nist.gov

References