CVE-2018-1273
Quick assessment
Affected
Spring by Pivotal Spring Framework
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Pivotal Software Spring Data Commons和Pivotal Software Spring Data REST都是美国Pivotal Software公司的产品。Pivotal Software Spring Data Commons是一款数据共享接口。Pivotal Software Spring Data REST是一款能够在Spring Data之上构建超媒体驱动的REST Web服务的产品。 Pivotal Software Spring Data Commons和S
Public Exploits 1
Nuclei · 1
CVE-2018-1273.yaml [template]
In-the-Wild Activity Observed
cisa_kev · confirmed
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Spring by Pivotal | Spring Framework | Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-1273
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Pivotal Software Spring Data Commons和Spring Data REST 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Pivotal Software Spring Data Commons和Pivotal Software Spring Data REST都是美国Pivotal Software公司的产品。Pivotal Software Spring Data Commons是一款数据共享接口。Pivotal Software Spring Data REST是一款能够在Spring Data之上构建超媒体驱动的REST Web服务的产品。 Pivotal Software Spring Data Commons和S
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring by Pivotal | Spring Framework | Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions | - |
|
II. Public POCs for CVE-2018-1273
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Environment for CVE-2018-1273 (Spring Data Commons) | https://github.com/knqyf263/CVE-2018-1273 | POC Details |
| 2 | POC for CVE-2018-1273 | https://github.com/wearearima/poc-cve-2018-1273 | POC Details |
| 3 | None | https://github.com/webr0ck/poc-cve-2018-1273 | POC Details |
| 4 | cve-2018-1273 | https://github.com/cved-sources/cve-2018-1273 | POC Details |
| 5 | Spring Data Commons RCE 远程命令执行漏洞 | https://github.com/jas502n/cve-2018-1273 | POC Details |
| 6 | Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1273.yaml | POC Details |
| 7 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E5%BC%80%E5%8F%91%E6%A1%86%E6%9E%B6%E6%BC%8F%E6%B4%9E/Spring%20Data%20Commons%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2018-1273.md | POC Details |
| 8 | https://github.com/vulhub/vulhub/blob/master/spring/CVE-2018-1273/README.md | POC Details | |
| 9 | None | https://github.com/hdgokani/CVE-2018-1273 | POC Details |
| 10 | None | https://github.com/andikahilmy/CVE-2018-1273-spring-data-commons-vulnerable | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-1273
请登录查看更多情报信息。
Vendor Advisories for CVE-2018-1273 (1)
-
https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC
Mailing List Discussions for CVE-2018-1273 (1)
Other References for CVE-2018-1273 (1)
-
https://pivotal.io/security/cve-2018-1273 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: Spring Framework
-
CVE-2026-59314
Spring Framework response splitting in ContentDisposition -
CVE-2026-59313
Server Sent Event stream corruption in Spring MVC functional -
CVE-2026-59283
Spring Framework Safety Guard Bypass via SpEL Expression Com -
CVE-2026-59282
Spring Framework Denial of Service via Unbounded List Growth -
CVE-2026-59281
Spring Framework Cross-site Scripting via EscapedErrors
Same weakness: CWE-94
-
CVE-2026-97670
Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrar -
CVE-2026-104021
Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator -
CVE-2026-108259
Tina: Code injection via unescaped Git branch name in genera -
CVE-2026-104082
SmarterMail < Build 9777 SysAdmin Remote Code Execution via -
CVE-2026-107806
Nginx UI: Authenticated Remote Code Execution via Backup Res
V. Comments for CVE-2018-1273
No comments yet