CVE-2018-1273

VMware Tanzu Spring Data Commons Property Binder Vulnerability

Spring Data Commons

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

11. Apr 2018

Ausgewertete Quellen

• Hersteller
  https://pivotal.io/security/cve-2018-1273
• Hinweis
  http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E
• Hinweis
  https://www.oracle.com/security-alerts/cpujul2022.html
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1273
• CISA
  VMware Tanzu Spring Data Commons Property Binder Vulnerability
• NVD
  CVE-2018-1273