Arbitrary Code Execution Affecting org.springframework.data:spring-data-commons package, versions [,1.13.11.RELEASE) [2.0.0.RELEASE,2.0.6.RELEASE)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORKDATA-32219
- published 16 Apr 2018
- disclosed 11 Apr 2018
- credit Philippe Arteau
Introduced: 11 Apr 2018
CVE-2018-1273 Open this link in a new tabHow to fix?
Upgrade org.springframework.data:spring-data-commons
to version 1.13.11.RELEASE, 2.0.6.RELEASE or higher.
Overview
org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds.
Affected versions of this package are vulnerable to Arbitrary Code Execution. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.