{"id":"CVE-2018-1273","kind":"vulnerability","aliases":["CVE-2018-1273"],"related":[],"title":"VMware Tanzu Spring Data Commons: VMware Tanzu Spring Data Commons Property Binder Vulnerability","description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.","summary":"Spring Data Commons has a property binding flaw that lets a remote attacker run code on the server. CISA lists it as actively exploited, and it has been used in ransomware campaigns.","severity":"critical","cvss":9.8,"epss":0.96956,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"VMware Tanzu Spring Data Commons","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","package","ransomware","spring","spring-data"],"not_affected_if":["unknown"],"how_to_check":"Check your Spring Data Commons version in the build file (pom.xml or build.gradle) against the vendor advisory; affected and fixed versions are unknown from these sources.","fix":"Apply the vendor update per VMware Tanzu guidance; the exact fixed version is unknown from these sources.","status":"open","published_at":"2018-04-11T13:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:21:47+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:21:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per VMware Tanzu guidance; the exact fixed version is unknown from these sources.","reach":"internet","impact":"high","summary":"Spring Data Commons has a property binding flaw that lets a remote attacker run code on the server. CISA lists it as actively exploited, and it has been used in ransomware campaigns.","category":"package","who_cares":["java","spring","spring-data"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the server via crafted request data.","analyst_note":"Find the affected and fixed Spring Data Commons versions and the trigger condition in the VMware Tanzu advisory for CVE-2018-1273; sources give no version range.","how_to_check":"Check your Spring Data Commons version in the build file (pom.xml or build.gradle) against the vendor advisory; affected and fixed versions are unknown from these sources.","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000474,"input_tokens":2840,"output_tokens":379,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1273':16A,19A '-2018':15A,18A '1.13':71C '1.13.10':73C '2.0':74C '2.0.5':76C 'activ':55B 'attack':45B,99C,132C 'back':110C 'base':120C 'bind':39B,123C 'binder':12A,84C 'campaign':64B 'caus':86C 'cisa':51B 'code':47B,130C 'common':5A,10A,35B,67C 'commons':24A 'contain':81C 'craft':103C 'cve':14A,17A 'data':4A,9A,23A,32B,34B,66C,108C,116C 'element':92C 'execut':131C 'exploit':25B,56B 'flaw':40B 'hat':124C 'http':111C 'improp':88C 'java':26B 'lead':126C 'let':42B 'list':52B 'malici':96C 'neutral':89C 'older':78C 'packag':27B 'paramet':105C 'payload':122C 'prior':69C 'project':119C 'projection-bas':118C 'properti':11A,38B,83C 'ransomwar':28B,63B 'remot':44B,95C,129C 'request':104C,121C 'resourc':112C 'rest':109C 'run':46B 'server':50B 'special':91C,102C 'spring':3A,8A,22A,29B,31B,33B,65C,107C,115C 'spring-data':30B 'suppli':101C 'tanzu':2A,7A,21A 'unauthent':94C 'unsupport':79C 'use':61B,114C 'user':97C 'version':68C,80C 'vmware':1A,6A,20A 'vulner':13A,85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-04-11T13:29:00+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-1273","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-1273","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:24+00:00","note":null},{"source":"epss","external_id":"CVE-2018-1273","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-1273","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-1273","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1273","severity":null,"published_at":"2018-04-11T13:29:00+00:00","modified_at":"2026-08-26T05:18:03+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}