Code injection in Spring Framework
Priority CRITICAL 100Exploited in the wildCWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.
Summary
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
Why it matters now
Exploitation Active In CISA KEV since 2022-03-25CISA due date 2022-04-15Known ransomware use
EPSS 0.96956 99th percentileScored 2026-11-07
Fix Partial org.springframework.data:spring-data-commons (Maven): 1.13.11, 2.0.6Red Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Spring by Pivotal | Spring Framework | Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions | — | No fix listed | CNA |
| — | org.springframework.data:spring-data-commons (Maven) | 1.13.0 to before 1.13.11 | 1.13.11 | Patch available | GHSA-4fq3-mr56-cg6r |
| — | org.springframework.data:spring-data-commons (Maven) | 2.0.0 to before 2.0.6 | 2.0.6 | Patch available | GHSA-4fq3-mr56-cg6r |
- Spring Framework VendorSpring by Pivotal Affected Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions Fixed in — No fix listed CNA
- org.springframework.data:spring-data-commons (Maven) Vendor— Affected 1.13.0 to before 1.13.11 Fixed in 1.13.11 Patch available GHSA-4fq3-mr56-cg6r
- org.springframework.data:spring-data-commons (Maven) Vendor— Affected 2.0.0 to before 2.0.6 Fixed in 2.0.6 Patch available GHSA-4fq3-mr56-cg6r
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* | up to 1.12.10; 1.13.0 – 1.13.10; 2.0.0 – 2.0.5 | Vulnerable | Broadcom |
| cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:* | 3.0.0 – 3.0.5 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:* | up to 2.5.10; 2.6.0 – 2.6.10 | Vulnerable | VMware |
| cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:* | 1.0.1 – 2.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:ignite:1.0.0:-:*:*:*:*:*:* | 1.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:ignite:1.0.0:rc3:*:*:*:*:*:* | 1.0.0 rc3 | Vulnerable | Apache |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* | 8.0.8.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* | 8.0.8.3.0 | Vulnerable | Oracle |
- cpe:2.3:a:broadcom:spring_data_commons:*:*:*:*:*:*:*:* Versions up to 1.12.10; 1.13.0 – 1.13.10; 2.0.0 – 2.0.5 Vulnerable ·Broadcom
- cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.0.5 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:* Versions up to 2.5.10; 2.6.0 – 2.6.10 Vulnerable ·VMware
- cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:* Versions 1.0.1 – 2.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:ignite:1.0.0:-:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:ignite:1.0.0:rc3:*:*:*:*:*:* Versions 1.0.0 rc3 Vulnerable ·Apache
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-4fq3-mr56-cg6r org.springframework.data:spring-data-commons (Maven) Fixed in 1.13.11 Advisory →
- Fix · GHSA-4fq3-mr56-cg6r org.springframework.data:spring-data-commons (Maven) Fixed in 2.0.6 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet |
Not affected: 3 products
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Integration Service 2
- Red Hat Mobile Application Platform 4
Timeline
- 2022-03-25 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2018-1273
- 2026-10-03 Alias added: GHSA-4fq3-mr56-cg6r
References
Advisory 4
Other 4
- https://github.com/spring-projects/spring-data-commons/issues/1721
- https://github.com/spring-projects/spring-data-commons/commit/ae1dd2741ce06d44a0966ecbd6f47beabde2b653
- https://github.com/spring-projects/spring-data-commons/commit/b1a20ae1e82a63f99b3afc6f2aaedb3bf4dc432a
- https://github.com/spring-projects/spring-data-commons
More Spring by Pivotal Spring Data Rest vulnerabilities
- TI-2017-05637 Improper input validation in Pivotal Spring Data REST and Spring Boot CVSS 3.0CRITICAL 9.8
- TI-2018-01164 XML external entity injection in Pivotal Spring Data Commons CVSS 3.0HIGH 7.5
- TI-2018-01179 Resource allocation without limits in Spring Framework CVSS 3.1HIGH 7.5
Sources
- CVE-2018-1273 · CVE Program
- CVE-2018-1273 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-4fq3-mr56-cg6r · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1273 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences