IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
9.8Kritik KEV Fidye yazılımında kullanılıyor

CVE-2018-1273VMware Tanzu Spring Data Commons Property Binder Vulnerability

Spring by Pivotal Spring Framework Yayım: (8 yıl önce)

Aktif olarak istismar ediliyor — VMware Tanzu Spring Data Commons Property Binder Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 25.03.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 15.04.2022.

Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-1273

Açıklama

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Zayıflık türü (CWE): CWE-94

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
apache ignite 1.0.1 – ≤ 2.5.0
broadcom spring data commons ≤ 1.12.10
oracle financial services crime and compliance management studio 8.0.8.2.0
pivotal software spring data rest 3.0.0 – ≤ 3.0.5
Spring by Pivotal Spring Framework Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions
vmware spring data rest ≤ 2.5.10

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (11)
  • cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* ≤ 1.12.10
  • cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* ≥ 1.13.0 ≤ 1.13.10
  • cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.0.5
  • cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:* ≥ 3.0.0 ≤ 3.0.5
  • cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:* ≤ 2.5.10
  • cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:* ≥ 2.6.0 ≤ 2.6.10
  • cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:* ≥ 1.0.1 ≤ 2.5.0
  • cpe:2.3:a:apache:ignite:1.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:apache:ignite:1.0.0:rc3:*:*:*:*:*:*
  • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*

Aynı üründe son açıklar — Spring Framework / Boot

3.7Düşük
CVE-2026-59314

Spring Framework response splitting in ContentDisposition

Spring Spring Framework

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.2…

6.1Orta
CVE-2026-59281

Spring Framework Cross-site Scripting via EscapedErrors

Spring Spring Framework

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScrip…