---
id: "CVE-2018-1273"
kind: "vulnerability"
aliases: ["CVE-2018-1273"]
title: "VMware Tanzu Spring Data Commons: VMware Tanzu Spring Data Commons Property Binder Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.96956
exploited: true
status: "open"
category: "package"
products: [{"name": "VMware Tanzu Spring Data Commons", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "package", "ransomware", "spring", "spring-data"]
not_affected_if: ["unknown"]
published_at: "2018-04-11T13:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-1273", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-1273", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1273", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# VMware Tanzu Spring Data Commons: VMware Tanzu Spring Data Commons Property Binder Vulnerability

Spring Data Commons has a property binding flaw that lets a remote attacker run code on the server. CISA lists it as actively exploited, and it has been used in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VMware Tanzu Spring Data Commons affected ? fixed ?

## How to check

Check your Spring Data Commons version in the build file (pom.xml or build.gradle) against the vendor advisory; affected and fixed versions are unknown from these sources.

## Fix

Apply the vendor update per VMware Tanzu guidance; the exact fixed version is unknown from these sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-1273
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-1273
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-1273

## From the sources

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_