{"id":"CVE-2018-1273","published":"2018-04-11T13:29:00Z","modified":"2026-08-26T05:18:03Z","title":"VMware Tanzu Spring Data Commons Property Binder Vulnerability","vendor":"VMware Tanzu","product":"Spring Data Commons","tier":"core","eol":null,"description":{"text":"Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a property binder vulnerability in VMware Tanzu's Spring Data Commons component, caused by improper neutralization of special elements. An unauthenticated remote attacker can exploit it by sending specially crafted request parameters to Spring Data REST-backed HTTP resources or through Spring Data's projection-based request payload binding, leading to remote code execution; no user interaction or specific configuration is noted, and the affected versions are those prior to 1.13.10 and 2.0.5 (with older unsupported versions also affected).","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:45Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.96956,"percentile":0.99889,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-1273","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-01-08","exploitedFirstSeen":"2019-01-08","ransomware":true,"evidence":[{"url":"https://www.lacework.com/blog/elf-of-the-month-new-lucky-ransomware-sample/","date":"2019-01-08"},{"url":"https://www.fortinet.com/blog/threat-research/closer-look-satan-ransomwares-propagation-technics","date":"2019-05-20"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-02&host_type=src&vulnerability=cve-2018-1273","date":"2023-12-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-03&host_type=src&vulnerability=cve-2018-1273","date":"2023-12-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-11&host_type=src&vulnerability=cve-2018-1273","date":"2023-12-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-25&host_type=src&vulnerability=cve-2018-1273","date":"2023-12-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-28&host_type=src&vulnerability=cve-2018-1273","date":"2023-12-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-01&host_type=src&vulnerability=cve-2018-1273","date":"2024-01-01"}],"evidenceTotal":788,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E","tags":["Mailing List","Third Party Advisory"]},{"url":"https://pivotal.io/security/cve-2018-1273","tags":["Vendor Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["Patch","Third Party Advisory"]},{"url":"http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E","tags":["Mailing List","Third Party Advisory"]},{"url":"https://pivotal.io/security/cve-2018-1273","tags":["Vendor Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1273","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote HTTP request exploits public-facing application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources","start":197,"end":346}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Successful exploitation yields remote code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"can lead to a remote code execution attack","start":415,"end":457}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","vulnerableRanges":[">=1.13.0, <1.13.11",">=2.0.0, <2.0.6"],"patched":["1.13.11","2.0.6"],"from":["GHSA-4fq3-mr56-cg6r"],"provenance":"source"}],"advisories":[{"id":"GHSA-4fq3-mr56-cg6r","url":"https://github.com/advisories/GHSA-4fq3-mr56-cg6r","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","vulnerableRanges":[">=1.13.0, <1.13.11"],"patched":["1.13.11"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4fq3-mr56-cg6r","url":"https://github.com/advisories/GHSA-4fq3-mr56-cg6r","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","vulnerableRanges":[">=2.0.0, <2.0.6"],"patched":["2.0.6"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2018-0500","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0500","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":1,"earliest":"2018-04-13","earliestUrl":"https://github.com/knqyf263/CVE-2018-1273","repos":[{"name":"jas502n/cve-2018-1273","url":"https://github.com/jas502n/cve-2018-1273","stars":58,"created":"2019-04-29"},{"name":"wearearima/poc-cve-2018-1273","url":"https://github.com/wearearima/poc-cve-2018-1273","stars":24,"created":"2018-04-17"},{"name":"knqyf263/CVE-2018-1273","url":"https://github.com/knqyf263/CVE-2018-1273","stars":10,"created":"2018-04-13"},{"name":"webr0ck/poc-cve-2018-1273","url":"https://github.com/webr0ck/poc-cve-2018-1273","stars":2,"created":"2018-10-05"},{"name":"cved-sources/cve-2018-1273","url":"https://github.com/cved-sources/cve-2018-1273","stars":0,"created":"2019-01-17"}]},"nuclei":[{"id":"CVE-2018-1273","name":"Spring Data Commons - Remote Code Execution","severity":"critical","path":"http/cves/2018/CVE-2018-1273.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1273.yaml"}],"first":{"date":"2018-04-13","source":"PoC-in-GitHub","url":"https://github.com/knqyf263/CVE-2018-1273"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2018-04-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1273","provenance":"source"},{"date":"2018-04-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/knqyf263/CVE-2018-1273","provenance":"source"},{"date":"2019-01-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.lacework.com/blog/elf-of-the-month-new-lucky-ransomware-sample/","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0500","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1444},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2852 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9989"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"6 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}