XML external entity injection in Pivotal Spring Data Commons
Priority MEDIUM 41CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-611 and the CVSS impact.
Summary
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.
Why it matters now
EPSS 0.04843 92nd percentileScored 2026-11-07
Fix Fixed org.springframework.data:spring-data-commons (Maven): 1.13.12, 2.0.7Red Hat: 2 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pivotal | Spring Data Commons | 1.13 prior to 1.13.12; 2.0 prior to 2.0.7 | — | No fix listed | CNA |
| — | org.springframework.data:spring-data-commons (Maven) | 1.13.0 to before 1.13.12 | 1.13.12 | Patch available | GHSA-m929-7fr6-cvjg |
| — | org.springframework.data:spring-data-commons (Maven) | 2.0.0 to before 2.0.7 | 2.0.7 | Patch available | GHSA-m929-7fr6-cvjg |
- Spring Data Commons VendorPivotal Affected 1.13 prior to 1.13.12; 2.0 prior to 2.0.7 Fixed in — No fix listed CNA
- org.springframework.data:spring-data-commons (Maven) Vendor— Affected 1.13.0 to before 1.13.12 Fixed in 1.13.12 Patch available GHSA-m929-7fr6-cvjg
- org.springframework.data:spring-data-commons (Maven) Vendor— Affected 2.0.0 to before 2.0.7 Fixed in 2.0.7 Patch available GHSA-m929-7fr6-cvjg
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* | 1.13 – 1.13.11; 2.0 – 2.0.6 | Vulnerable | Broadcom |
| cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:* | 3.0 – 3.0.6 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:* | after 2.6, up to 2.6.11 | Vulnerable | VMware |
| cpe:2.3:a:xmlbeam:xmlbeam:*:*:*:*:*:*:*:* | up to 1.4.14 | Vulnerable | Xmlbeam |
- cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* Versions 1.13 – 1.13.11; 2.0 – 2.0.6 Vulnerable ·Broadcom
- cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:* Versions 3.0 – 3.0.6 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:* Versions after 2.6, up to 2.6.11 Vulnerable ·VMware
- cpe:2.3:a:xmlbeam:xmlbeam:*:*:*:*:*:*:*:* Versions up to 1.4.14 Vulnerable ·Xmlbeam
Remediation
- Fix · GHSA-m929-7fr6-cvjg org.springframework.data:spring-data-commons (Maven) Fixed in 1.13.12 Advisory →
- Fix · GHSA-m929-7fr6-cvjg org.springframework.data:spring-data-commons (Maven) Fixed in 2.0.7 Advisory →
Red Hat 2 advisories
- RHSA-2018:3768 Released 2018-12-04 · Red Hat rating ImportantRed Hat Fuse 7.2 security update
- Red Hat Fuse 7.2
- RHSA-2018:1809 Released 2018-06-07 · Red Hat rating ImportantRed Hat OpenShift Application Runtimes Spring Boot security and bug fix update
- Text-Only RHOAR
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7.2 | Fixed | RHSA-2018:3768 |
| Text-Only RHOAR | Fixed | RHSA-2018:1809 |
Not affected: 3 products
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Integration Service 2
- Red Hat Mobile Application Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1259
- 2026-10-03 Alias added: GHSA-m929-7fr6-cvjg
References
More Pivotal vulnerabilities
- TI-2017-05637 Improper input validation in Pivotal Spring Data REST and Spring Boot CVSS 3.0CRITICAL 9.8
- TI-2016-04299 When processing authorization requests using the whitelabel views in Spring Security… CVSS 3.0HIGH 8.8
- TI-2018-01165 Code injection in Pivotal Spring Security OAuth CVSS 3.0CRITICAL 9.8
- TI-2018-11237 DoS Attack via Range Requests CVSS 3.1HIGH 7.5
- TI-2019-02791 Apps Manager unverified SSL certs in Cloud Controller proxy CVSS 3.0CRITICAL 9.8
- TI-2018-11239 On Demand Services SDK Timing Attack Vulnerability CVSS 3.0CRITICAL 9.8
Sources
- CVE-2018-1259 · CVE Program
- CVE-2018-1259 · NVD
- FIRST EPSS
- GHSA-m929-7fr6-cvjg · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1259 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences