CVE-2018-1273 – VMware Tanzu Spring Data Commons Property Binder Vulnerability

https://notcve.org/view.php?id=CVE-2018-1273

11 Apr 2018 — Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack. Spring Data Commons, en versiones anteriores a las co... • https://github.com/knqyf263/CVE-2018-1273 • CWE-20: Improper Input Validation CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •