cve-2018-1273

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-1273.json"
      }
    ],
    "title": "spring-data-commons: Improper neutralization of special elements allow remote attackers to execute code via crafted requests",
    "tracking": {
      "current_release_date": "2026-08-04T18:32:27+00:00",
      "generator": {
        "date": "2026-08-04T18:32:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "CVE-2018-1273",
      "initial_release_date": "2018-03-27T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2018-03-27T00:00:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-04T11:54:10+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-08-04T18:32:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Fuse 7",
                "product": {
                  "name": "Red Hat Fuse 7",
                  "product_id": "red_hat_fuse_7",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Fuse 7"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6",
                "product": {
                  "name": "Red Hat JBoss Fuse 6",
                  "product_id": "red_hat_jboss_fuse_6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse 6"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse Integration Service 2",
                "product": {
                  "name": "Red Hat JBoss Fuse Integration Service 2",
                  "product_id": "red_hat_jboss_fuse_integration_service_2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:fuse_integration_services:2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse Integration Service 2"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Mobile Application Platform 4",
                "product": {
                  "name": "Red Hat Mobile Application Platform 4",
                  "product_id": "red_hat_mobile_application_platform_4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:mobile_application_platform:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Mobile Application Platform 4"
          },
          {
            "category": "product_version",
            "name": "spring-data-commons",
            "product": {
              "name": "spring-data-commons",
              "product_id": "spring-data-commons",
              "product_identification_helper": {
                "purl": "pkg:maven/org.springframework.data/spring-data-commons"
              }
            }
          },
          {
            "category": "product_version",
            "name": "spring-data-commons.src",
            "product": {
              "name": "spring-data-commons.src",
              "product_id": "spring-data-commons.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/spring-data-commons?arch=src"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spring-data-commons as a component of Red Hat Fuse 7",
          "product_id": "red_hat_fuse_7:spring-data-commons"
        },
        "product_reference": "spring-data-commons",
        "relates_to_product_reference": "red_hat_fuse_7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spring-data-commons as a component of Red Hat JBoss Fuse 6",
          "product_id": "red_hat_jboss_fuse_6:spring-data-commons"
        },
        "product_reference": "spring-data-commons",
        "relates_to_product_reference": "red_hat_jboss_fuse_6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spring-data-commons as a component of Red Hat JBoss Fuse Integration Service 2",
          "product_id": "red_hat_jboss_fuse_integration_service_2:spring-data-commons"
        },
        "product_reference": "spring-data-commons",
        "relates_to_product_reference": "red_hat_jboss_fuse_integration_service_2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spring-data-commons.src as a component of Red Hat Mobile Application Platform 4",
          "product_id": "red_hat_mobile_application_platform_4:spring-data-commons.src"
        },
        "product_reference": "spring-data-commons.src",
        "relates_to_product_reference": "red_hat_mobile_application_platform_4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-1273",
      "cwe": {
        "id": "CWE-138",
        "name": "Improper Neutralization of Special Elements"
      },
      "discovery_date": "2018-04-11T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "red_hat_jboss_fuse_6:spring-data-commons",
            "red_hat_jboss_fuse_integration_service_2:spring-data-commons",
            "red_hat_mobile_application_platform_4:spring-data-commons.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1565923"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "spring-data-commons: Improper neutralization of special elements allow remote attackers to execute code via crafted requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "red_hat_fuse_7:spring-data-commons"
        ],
        "known_not_affected": [
          "red_hat_jboss_fuse_6:spring-data-commons",
          "red_hat_jboss_fuse_integration_service_2:spring-data-commons",
          "red_hat_mobile_application_platform_4:spring-data-commons.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-1273"
        },
        {
          "category": "external",
          "summary": "RHBZ#1565923",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1565923"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1273",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-1273"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1273",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1273"
        },
        {
          "category": "external",
          "summary": "https://pivotal.io/security/cve-2018-1273",
          "url": "https://pivotal.io/security/cve-2018-1273"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2018-03-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "red_hat_fuse_7:spring-data-commons"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "red_hat_fuse_7:spring-data-commons",
            "red_hat_jboss_fuse_6:spring-data-commons",
            "red_hat_jboss_fuse_integration_service_2:spring-data-commons",
            "red_hat_mobile_application_platform_4:spring-data-commons.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-03-25T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical",
          "product_ids": [
            "red_hat_fuse_7:spring-data-commons",
            "red_hat_jboss_fuse_6:spring-data-commons",
            "red_hat_jboss_fuse_integration_service_2:spring-data-commons",
            "red_hat_mobile_application_platform_4:spring-data-commons.src"
          ]
        }
      ],
      "title": "spring-data-commons: Improper neutralization of special elements allow remote attackers to execute code via crafted requests"
    }
  ]
}