CVE-2018-1259
Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references
Also known as GHSA-m929-7fr6-cvjg
Published 8 y ago · modified 4 mo ago · JSON
Summary
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.
Exploit prediction (EPSS)
4.84% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.data:spring-data-commons | >=1.13.0, <1.13.12 >=2.0.0, <2.0.7 | 1.13.12 2.0.7 |
Affected products
- Pivotal Spring Data Commons
Classification
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
References
- access.redhat.com /errata/RHSA-2018:1809 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2018:3768 · vendor-advisory, x_refsource_REDHAT, x_transferred
- oracle.com /security-alerts/cpujul2022.html · x_refsource_MISC, x_transferred
- pivotal.io /security/cve-2018-1259 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-1259 · advisory
- github.com /advisories/GHSA-m929-7fr6-cvjg · advisory
Sources
- CVE List: CVE-2018-1259
- GitHub Advisory: GHSA-m929-7fr6-cvjg
- NVD: CVE-2018-1259
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.