CVE-2018-1273

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.970 · 100 %ileexploit · PoCDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 7 exploits · PoC

Likely / severe?

97.0% (100th) EPSS

CVSS 7.5 · high

Is it mine?

47 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2022-03-25remediate by 2022-04-15

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-23

VMware Tanzu Spring Data Commons Property Binder Vulnerability

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-94USCWE-94USCWE-94US

exploits (7)

Public proof-of-concept and weaponised exploit code.

CyberCTF/vulhub-spring-cve-2018-1273Vulhub spring/CVE-2018-1273: Spring Data Commons SpEL Injection (CVE-2018-1273), run with IsoloomPoC · poc_in_github
cved-sources/cve-2018-1273cve-2018-1273PoC · poc_in_github
hdgokani/CVE-2018-1273hdgokani/CVE-2018-1273PoC · poc_in_github
jas502n/cve-2018-1273Spring Data Commons RCE 远程命令执行漏洞PoC · poc_in_github
knqyf263/CVE-2018-1273Environment for CVE-2018-1273 (Spring Data Commons)PoC · poc_in_github
wearearima/poc-cve-2018-1273POC for CVE-2018-1273PoC · poc_in_github

affected products (47)

Products and version ranges known to be affected.

Hitachi Ops Centerall versionscert_bundDEcpe:/a:hitachi:ops_center:-
IBM Security Guardium 11.3all versionscert_bundDEcpe:/a:ibm:security_guardium:11.3
IBM Security Guardium 11.5all versionscert_bundDEcpe:/a:ibm:security_guardium:11.5
Oracle Communications 1.11.0all versionscert_bundDEcpe:/a:oracle:communications:1.11.0
Oracle Communications 10.4.0.4.1all versionscert_bundDEcpe:/a:oracle:communications:10.4.0.4.1
Oracle Communications 22.0.0.0.0all versionscert_bundDEcpe:/a:oracle:communications:22.0.0.0.0
Oracle Communications 22.1.0all versionscert_bundDEcpe:/a:oracle:communications:22.1.0
Oracle Communications 22.1.0.0.0all versionscert_bundDEcpe:/a:oracle:communications:22.1.0.0.0
Oracle Communications 22.1.1all versionscert_bundDEcpe:/a:oracle:communications:22.1.1
Oracle Communications 22.2.0all versionscert_bundDEcpe:/a:oracle:communications:22.2.0
Oracle Communications 22.2.1all versionscert_bundDEcpe:/a:oracle:communications:22.2.1
Oracle Communications 22.2.2all versionscert_bundDEcpe:/a:oracle:communications:22.2.2
Oracle Communications 22.2.3all versionscert_bundDEcpe:/a:oracle:communications:22.2.3
Oracle Communications 22.2.4all versionscert_bundDEcpe:/a:oracle:communications:22.2.4
Oracle Communications 22.3.0all versionscert_bundDEcpe:/a:oracle:communications:22.3.0
Oracle Communications 22.3.1all versionscert_bundDEcpe:/a:oracle:communications:22.3.1
Oracle Communications 22.3.2all versionscert_bundDEcpe:/a:oracle:communications:22.3.2
Oracle Communications 22.3.3all versionscert_bundDEcpe:/a:oracle:communications:22.3.3
Oracle Communications 22.3.4all versionscert_bundDEcpe:/a:oracle:communications:22.3.4
Oracle Communications 22.4.1all versionscert_bundDEcpe:/a:oracle:communications:22.4.1

showing 20 of 47

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-0137Oracle Communications: Mehrere SchwachstellenDeutsch2023-01-17csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-4fq3-mr56-cg6rSpring Data Commons remote code injection vulnerability2018-10-17ghsa · osvUS
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding that can lead to a remote code execution attack.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2018-04-11modified 2026-06-26

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan