Russian Vulnerability Scanner Database

Back to List

CVE-2018-1273

Scores

EPSS Score

0.9434

CVSS

3.x 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All CVSS Scores

CVSS 4.0
0.0
CVSS 3.x
9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0
7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Spring Data Commons, версии до 1.13 до 1.13.10, 2.0 до 2.0.5 и старые неподдерживаемые версии, содержат уязвимость привязки свойства, вызванную неправильной нейтрализацией специальных элементов. Неаутентифицированный удалённый злоумышленник (или атака) может предоставить специально созданные параметры запроса для ресурсов HTTP, поддерживаемых Spring Data REST, или использовать привязку полезной нагрузки запроса на основе проекции Spring Data, что может привести к атаке выполнения кода удалённо.

Sources

nvd

CWEs

CWE-138CWE-94

Related Vulnerabilities

BDU:2022-06726

Exploits

Exploit ID: CVE-2018-1273

Source: cisa

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Reference Links

http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E
https://pivotal.io/security/cve-2018-1273
https://www.oracle.com/security-alerts/cpujul2022.html
http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E
https://pivotal.io/security/cve-2018-1273
https://www.oracle.com/security-alerts/cpujul2022.html
https://www.cve.org/CVERecord?id=CVE-2018-1273 https://nvd.nist.gov/vuln/detail/CVE-2018-1273 https://pivotal.io/security/cve-2018-1273 https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://bugzilla.redhat.com/show_bug.cgi?id=1565923

Vulnerable Software

Type: Configuration

Vendor: apache

Product: ignite

Operating System: * * *

Trait: 
{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:*",
      "versionEndIncluding": "2.5.0",
      "versionStartIncluding": "1.0.1",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:apache:ignite:1.0.0:-:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:apache:ignite:1.0.0:rc3:*:*:*:*:*:*",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd

Type: Configuration

Vendor: oracle

Product: financial_services_crime_and_compliance_management_studio

Operating System: * * *

Trait: 
{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd

Type: Configuration

Vendor: pivotal_software

Product: spring_data_commons

Operating System: * * *

Trait: 
{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:*",
      "versionEndIncluding": "1.12.10",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:*",
      "versionEndIncluding": "1.13.10",
      "versionStartIncluding": "1.13.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:*",
      "versionEndIncluding": "2.0.5",
      "versionStartIncluding": "2.0.0",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd

Type: Configuration

Vendor: pivotal_software

Product: spring_data_rest

Operating System: * * *

Trait: 
{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*",
      "versionEndIncluding": "2.5.10",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*",
      "versionEndIncluding": "2.6.10",
      "versionStartIncluding": "2.6.0",
      "vulnerable": true
    },
    {
      "cpe23uri": "cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*",
      "versionEndIncluding": "3.0.5",
      "versionStartIncluding": "3.0.0",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd