{"cve":{"cve_id":"CVE-2018-1273","is_kev":true,"kev_date_added":"2022-03-25","kev_vendor_project":"VMware Tanzu","kev_product":"Spring Data Commons","kev_vulnerability_name":"VMware Tanzu Spring Data Commons Property Binder Vulnerability","kev_short_description":"Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.","kev_required_action":"Apply updates per vendor instructions.","kev_due_date":"2022-04-15","kev_known_ransomware":true,"kev_notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-1273","kev_cwes":["CWE-94"],"epss_score":0.95715,"epss_percentile":0.99866,"epss_as_of":"2026-08-26","description":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.","published_at":"2018-04-11T13:00:00Z","last_modified_at":"2026-08-26T05:18:03.100000Z","cvss_v3_score":9.8,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_v3_severity":"CRITICAL","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":"active","ssvc_automatable":true,"ssvc_technical_impact":"total","cwes":["CWE-94"],"nvd_references":["http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E","https://www.oracle.com/security-alerts/cpujul2022.html","https://pivotal.io/security/cve-2018-1273"],"vuln_status":"Analyzed","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-06-24T00:09:31.350578Z","updated_at":"2026-08-27T17:38:41.369924Z"},"effective_severity":"CRITICAL","badges":["kev","ransomware","poc","epss"],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"H","value_label":"High"},{"metric":"I","name":"Integrity","value":"H","value_label":"High"},{"metric":"A","name":"Availability","value":"H","value_label":"High"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"apache","vendor_name":"apache","product_slug":"ignite","product_name":"ignite","version_start":"1.0.1","version_start_inclusive":true,"version_end":"2.5.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:*"},{"vendor_slug":"apache","vendor_name":"apache","product_slug":"ignite","product_name":"ignite","version_start":"1.0.0","version_start_inclusive":true,"version_end":"1.0.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:apache:ignite:1.0.0:rc3:*:*:*:*:*:*"},{"vendor_slug":"apache","vendor_name":"apache","product_slug":"ignite","product_name":"ignite","version_start":"1.0.0","version_start_inclusive":true,"version_end":"1.0.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:apache:ignite:1.0.0:-:*:*:*:*:*:*"},{"vendor_slug":"broadcom","vendor_name":"Broadcom","product_slug":"spring-data-commons","product_name":"spring_data_commons","version_start":null,"version_start_inclusive":null,"version_end":"1.12.10","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"financial-services-crime-and-compliance-management-studio","product_name":"financial_services_crime_and_compliance_management_studio","version_start":"8.0.8.3.0","version_start_inclusive":true,"version_end":"8.0.8.3.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*"},{"vendor_slug":"oracle","vendor_name":"oracle","product_slug":"financial-services-crime-and-compliance-management-studio","product_name":"financial_services_crime_and_compliance_management_studio","version_start":"8.0.8.2.0","version_start_inclusive":true,"version_end":"8.0.8.2.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*"},{"vendor_slug":"pivotal-software","vendor_name":"pivotal_software","product_slug":"spring-data-rest","product_name":"spring_data_rest","version_start":"3.0.0","version_start_inclusive":true,"version_end":"3.0.5","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*"},{"vendor_slug":"spring-by-pivotal","vendor_name":"Spring by Pivotal","product_slug":"spring-framework","product_name":"Spring Framework","version_start":"Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions","version_start_inclusive":true,"version_end":"Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions","version_end_inclusive":true,"cpe23_uri":"cve5:spring-by-pivotal:spring-framework:Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions:Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions"},{"vendor_slug":"vmware","vendor_name":"VMware","product_slug":"spring-data-rest","product_name":"spring_data_rest","version_start":null,"version_start_inclusive":null,"version_end":"2.5.10","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*"}],"exploit_refs":[{"source":"nuclei","kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1273.yaml","title":"Spring Data Commons - Remote Code Execution","author":"dwisiswant0","disclosed_at":null}],"news":[],"references":[{"url":"http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E","source_type":"MISC","tags":[]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","source_type":"VENDOR_ADVISORY","tags":["advisory"]},{"url":"https://pivotal.io/security/cve-2018-1273","source_type":"MISC","tags":[]}],"timeline":[{"type":"published","at":"2018-04-11T13:00:00Z","label":"CVE published","source":null},{"type":"cisa_reported","at":"2022-03-25T00:00:00Z","label":"Added to CISA KEV catalog","source":"kev"},{"type":"poc_available","at":"2026-06-24T00:29:48.638073Z","label":"Public PoC available","source":"nuclei"},{"type":"ssvc_changed","at":"2026-06-24T00:31:12.162116Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-06-24T00:31:12.162116Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-06-24T00:31:12.162116Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-06-24T00:31:12.162116Z","label":"CVSS score revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-06-24T00:31:12.162116Z","label":"CVSS score revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-06-24T00:31:12.162116Z","label":"CVSS score revised","source":"vulnrichment"}]}