CVE-2018-1273

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-1273
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1273.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-1273
Aliases
Published
2018-04-11T13:29:00.290Z
Modified
2026-03-15T22:19:05.238248Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

References

Affected packages

Git / github.com/apache/ignite

Affected ranges

Type
GIT
Repo
https://github.com/apache/ignite
Events
Introduced
fceebf26559068eac36b7395a7c6d51229c33469
Last affected
86e110c750a340dc9be2d396415f0b80d7ed8813
Database specific 
{
    "versions": [
        {
            "introduced": "1.0.1"
        },
        {
            "last_affected": "2.5.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/spring-projects/spring-data-commons
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f386cd6e47d018c2f7640869bf5595797e3f74c0
Introduced
d5cad6c27f765587a3976620324153352058a4a7
Last affected
8ddb7cefe1fb0ba075dbbdc7035ab7e2a5c75c19
Introduced
dc8583795871a09d78a15b075935a6cada57d597
Last affected
70ac316b400937d7e1dff71c1605a4205fc818bd
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.12.10"
        },
        {
            "introduced": "1.13.0"
        },
        {
            "last_affected": "1.13.10"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/spring-projects/spring-data-rest
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f56485d92daceaca47e050d15f0088265852d7d8
Introduced
93a2c589c5efc9e550b15103ba707c2b60f8725c
Last affected
f916233f410b9d27e2ddb23de4c9ff1e29af29b5
Introduced
ac2cbfcbc5954384cb92da7ed2641d1e06322827
Last affected
9c57b4c8a13edc7988ab28b2770c14e49cb5b52c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
84004e0d1d7e92bea3e692f1a3bc50e79ab23161
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2e997b2a4bfe97feedf7c171cb09ce60a6d74dee
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5.10"
        },
        {
            "introduced": "2.6.0"
        },
        {
            "last_affected": "2.6.10"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.0-rc3"
        }
    ]
}

Affected versions

1.*
1.13.0.RELEASE
1.13.1.RELEASE
1.13.10.RELEASE
1.13.2.RELEASE
1.13.3.RELEASE
1.13.4.RELEASE
1.13.5.RELEASE
1.13.6.RELEASE
1.13.7.RELEASE
1.13.8.RELEASE
1.13.9.RELEASE
2.*
2.0.0.RELEASE
2.0.1.RELEASE
2.0.2.RELEASE
2.0.3.RELEASE
2.0.4.RELEASE
2.0.5.RELEASE
2.6.0.RELEASE
2.6.1.RELEASE
2.6.10.RELEASE
2.6.2.RELEASE
2.6.3.RELEASE
2.6.4.RELEASE
2.6.5.RELEASE
2.6.6.RELEASE
2.6.7.RELEASE
2.6.8.RELEASE
2.6.9.RELEASE
3.*
3.0.0.RELEASE
3.0.1.RELEASE
3.0.2.RELEASE
3.0.3.RELEASE
3.0.4.RELEASE
3.0.5.RELEASE

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.8.2.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.8.3.0"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1273.json"