Live › vulnerability › CVE-2018-1273
Go to dashboardSpring Data Commons has a property binding flaw that lets a remote attacker run code on the server. CISA lists it as actively exploited, and it has been used in ransomware campaigns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VMware Tanzu Spring Data Commons | vendor | – | – |
Check your Spring Data Commons version in the build file (pom.xml or build.gradle) against the vendor advisory; affected and fixed versions are unknown from these sources.
Apply the vendor update per VMware Tanzu guidance; the exact fixed version is unknown from these sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
This page as .md · .json · in your agent: get_signal("CVE-2018-1273")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.