CriticalCVE-2018-1273

    VMware Tanzu Spring Data Commons Property Binder Vulnerability (CVE-2018-1273)

    Published Last modified In CISA KEV since Sources: CVE.org, OSV

    What is affected, what to do

    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

    The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Spring Framework eq Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions..Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    9.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    9.8

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: CVE.org, OSV

    97.0 %

    EPSS score

    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

    Source: FIRST EPSS, percentile 99.89

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    253.82 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploited
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    9.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    97.0 %
    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    99.89
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CISA assessment (SSVC)
    Exploitation: active · automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 11 March 2022
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-94

    Response and mitigation

    Why act now?

    Prioritisation rationale

    The flaw is network-reachable without authentication and yields remote code execution, so confidentiality, integrity and availability are all fully at risk. CISA flags it as used in ransomware campaigns, and its exploitation likelihood ranks among the very highest in the entire CVE corpus; working public PoCs (including a Metasploit module) have existed for years and feature in routine mass-scanning. Treat as P1 for any system exposing Spring Data REST or projection-based binding, especially where the application server is reachable from the internet or semi-trusted partner networks; internally used instances go to P2 with a 7-day patch SLA. Oracle FCCM Studio and Apache Ignite inherit the same urgency because they bundle Spring Data Commons transitively.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Patch Spring Data Commons without delay: upgrade to 1.13.10, 2.0.5 or later; for Spring Boot bump the dependency-management pin (spring-data-releasetrain.version to Ingalls-SR10 or Kay-SR5). Verify transitive dependencies in fat JARs/WARs via mvn dependency:tree or gradle dependencies.
      • Inventory every Java workload (Tomcat, Jetty, embedded Spring Boot, Pivotal tc Server, WebLogic hosting Spring apps) for spring-data-commons-*.jar — PowerShell Get-ChildItem -Recurse -Filter spring-data-commons*.jar, Linux find / -name 'spring-data-commons*.jar' 2>/dev/null.
      • Place exposed Spring Data REST endpoints (typically /users, /customers, repository resource paths) behind a reverse proxy/WAF immediately, or disable them if unused. Perimeter-scan for external reachability and block via ACL until patched.
      • Oracle Financial Services Crime and Compliance Management Studio 8.0.8.2.0: apply the vendor fix via My Oracle Support — look up the exact patch ID in the current Oracle CPU advisory. Upgrade Apache Ignite 1.x/2.x to a current 2.x release.
      • Incident readiness: snapshot affected hosts for forensics before the patch overwrites evidence. Inspect Java processes for unusual child processes (sh, bash, cmd.exe, powershell.exe).

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: never expose Spring Data REST endpoints directly to the internet. Perimeter rule: inbound HTTP/HTTPS to application-server pools only through a reverse proxy performing request-body filtering.
      • WAF/IPS: rule against property-binder payloads — block request parameters and JSON keys starting with T(, SpEL markers ${...}, new java.lang.ProcessBuilder, and bracket structures inside property names ([, ] in keys). Snort/Suricata signatures for CVE-2018-1273 exist in the common ET rulesets — enable them in alert+block mode.
      • Application-side: when patching is impossible short-term, disable Spring Data REST (remove @EnableSpringDataWebSupport or move spring.data.rest.base-path to a non-public path) and switch off projection-based request payload binding.
      • Container hardening: run Java containers with readOnlyRootFilesystem: true, runAsNonRoot: true, dropped capabilities (NET_RAW, SYS_ADMIN). Egress policy: application pods may only reach defined DB/service targets, no outbound internet (prevents second-stage download).
      • Least privilege: the JVM service account must not be able to spawn a shell; enforce an SELinux/AppArmor profile for the Tomcat/Spring Boot process that denies execve into /bin/*, /usr/bin/*.

    3. Runbook step 3

      Detection rules

      • EDR/Sysmon EID 1 (Process Create): alert when java.exe/java spawns a shell or LOLBin (cmd.exe, powershell.exe, sh, bash, curl, wget, nc). KQL shape: DeviceProcessEvents | where InitiatingProcessFileName == "java.exe" and FileName in ("powershell.exe","cmd.exe","wscript.exe","cscript.exe").
      • Web access logs: grep for request parameters containing T(java.lang.Runtime), getRuntime().exec, [ inside query keys or POST-JSON keys. Sample regex: \bT\(\s*(java|org)\..
      • Suricata/Zeek: HTTP payload inspection for SpEL expression markers in POST bodies against Spring Data REST paths; Sigma rule shape: detection: selection: cs-method: POST; cs-uri-stem|contains: '/users'; cs-body|contains: 'T(java.lang'.
      • Linux auditd: execve rule on child processes under the Java UID (-a always,exit -F arch=b64 -S execve -F auid=<javauser>); unexpected shells are an IoC.
      • Network telemetry: outbound connections from app-server segments to non-business destinations, especially TCP/80, TCP/443, TCP/4444 or DNS lookups for pastebin, raw.githubusercontent, dynamic DNS providers.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

    Source: NVD (NIST), OSV (Open Source Vulnerabilities), CISA KEV Catalog, cvelistv5

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    Spring by PivotalSpring Framework
    • Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions
    • —
    apacheignite
    • 1.0.1 – ≤ 2.5.0
    • 1.0.0
    • —
    • —
    broadcomspring_data_commons
    • ≤ 1.12.10
    • 1.13.0 – ≤ 1.13.10
    • 2.0.0 – ≤ 2.0.5
    • —
    • —
    • —
    oraclefinancial_services_crime_and_compliance_management_studio
    • 8.0.8.3.0
    • 8.0.8.2.0
    • —
    • —
    pivotal_softwarespring_data_rest
    • 3.0.0 – ≤ 3.0.5
    • —
    vmwarespring_data_rest
    • 2.6.0 – ≤ 2.6.10
    • ≤ 2.5.10
    • —
    • —
    mavenorg.springframework.data:spring-data-commons
    • 2.0.0.RELEASE
    • 1.13.2.RELEASE
    • 2.0.1.RELEASE
    • 1.13.0
    • 2.0.4.RELEASE
    • 2.0.5.RELEASE
    • 1.13.4.RELEASE
    • 2.0.2.RELEASE
    • 2.0.3.RELEASE
    • 1.13.8.RELEASE
    • 1.13.7.RELEASE
    • 1.13.0.RELEASE
    • 1.13.1.RELEASE
    • 2.0.0
    • 1.13.6.RELEASE
    • 1.13.5.RELEASE
    • 1.13.10.RELEASE
    • 1.13.9.RELEASE
    • 1.13.3.RELEASE
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —

    Vendors and products

    Weakness classes (CWE)

    • CWE-94Improper Control of Generation of Code ('Code Injection')

      Base

      The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

      Entry at MITRE CWE-94

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited
    PoC-in-GitHub (nomi-sec)vulhub-spring-cve-2018-1273 (opens in a new tab)github.comPoC (publicly reported)reported, not verified

    References & sources

    • NVD (NIST)vuln/detail/CVE-2018-1273advisory
    • github.comspring-projects/spring-data-commons/issues/1721web
    • github.comspring-projects/spring-data-commons/commit/ae1dd2741ce06d44a096…web
    • github.comspring-projects/spring-data-commons/commit/b1a20ae1e82a63f99b3a…web
    • GitHub Security Advisoriesadvisories/GHSA-4fq3-mr56-cg6radvisory
    • github.comspring-projects/spring-data-commonspackage
    • pivotal.iosecurity/cve-2018-1273web, x_refsource_CONFIRM, Vendor advisory
    • oracle.comsecurity-alerts/cpujul2022.htmlweb, x_refsource_MISC, Patch, Third-party advisory
    • mail-archives.apache.org[ignite-dev] 20180719 [CVE-2018-1273] Apache Ignite impacted by security vulnerability in Spring Data Commonsweb, Mailing list, x_refsource_MLIST, Mailing list, Third-party advisory
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1273government-resource, US government resource

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. Product identifiers remappedNVD

      Product mapping changed:
      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Product configurationchanged
      OR *cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:* versions from (including) 1.12.10
      OR *cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* versions from (including) 1.12.10

      Source identifier: nvd@nist.gov

    2. Product identifiers remappedNVD

      Product mapping changed:
      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Product configurationchanged
      OR *cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:* versions from (including) 1.13.0 from (including) 1.13.10
      OR *cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* versions from (including) 1.13.0 from (including) 1.13.10

      Source identifier: nvd@nist.gov

    3. Product identifiers remappedNVD

      Product mapping changed:
      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Product configurationchanged
      OR *cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:* versions from (including) 2.0.0 from (including) 2.0.5
      OR *cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* versions from (including) 2.0.0 from (including) 2.0.5

      Source identifier: nvd@nist.gov

    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2018-1273
    <a href="https://intel.neosec.eu/en/cve/CVE-2018-1273"><img src="https://intel.neosec.eu/badge/cve/CVE-2018-1273.svg?lang=en" alt="CVE-2018-1273 – NEOSEC Intel" height="20"></a>