Log in Start free

Actively exploited · Published Apr 11, 2018 · Assigned by dell

CVE-2018-1273

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity code injection in Spring Framework from Spring by Pivotal. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 97.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)97.0%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Mar 25, 2022
Attack tooling2Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.springframework.data:spring-data-commons1.13.11GHSA-4fq3-mr56-cg6r
Mavenorg.springframework.data:spring-data-commons2.0.6GHSA-4fq3-mr56-cg6r

Affected products (as reported)

VendorProductVersions
Spring by Pivotal Spring Framework Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References