CVE-2018-1273
| Affected software | 5 products, listed below |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 3 scores |
| Fixed in | 1.13.11, 2.0.6 |
| Weakness | Code injection (CWE-94) |
| Published | 11 Apr 2018 |
| Updated | 29 Sep 2026 |
Description
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CWE-20 · Improper input validation
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-25 · remediation due 2022-04-15 · ransomware use: known
- VulnCheck KEV listed Exploitation reported in the wild. 5 citations · honeypot sightings · 4 exploits · earliest 2019-01-08.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 7 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2018-04-13.
- EPSS 97% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2018-1273 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 793 days | 2023-12-02 to 2026-11-12 |
| Reported exploitation | lacework.com | /blog/elf-of-the-month-new-lucky-ransomware-sample | 2019-01-08 |
| Reported exploitation | fortinet.com | /blog/threat-research/closer-look-satan-ransomwares-propagation-technics | 2019-05-20 |
| Reported exploitation | web.archive.org | /web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf | 2019-09-01 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2022-03-25 |
| Reported exploitation | greynoise.io | /blog/battling-ransomware-one-tag-at-a-time | 2024-02-08 |
| Exploit reference | VulnCheck XDB d764935a0636 | Exploit type: initial-access | 2018-04-13 |
| Exploit reference | VulnCheck XDB 9406cebce0df | Exploit type: initial-access | 2023-12-21 |
| Exploit reference | VulnCheck XDB 7813a73559db | Exploit type: initial-access | 2025-06-25 |
| Exploit reference | VulnCheck XDB a9319a856061 | Exploit type: initial-access | 2026-10-08 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Spring Data Commons RCE 远程命令执行漏洞 | 58 | 2019-04-29 |
| GitHub PoC | POC for CVE-2018-1273 | 24 | 2018-04-17 |
| GitHub PoC | Environment for CVE-2018-1273 (Spring Data Commons) | 10 | 2018-04-13 |
| GitHub PoC | webr0ck/poc-cve-2018-1273 | 2 | 2018-10-05 |
| GitHub PoC | Vulhub spring/CVE-2018-1273: Spring Data Commons SpEL Injection (CVE-2018-1273), run with Isoloom | 2026-10-08 | |
| GitHub PoC | cve-2018-1273 | 2019-01-17 | |
| Nuclei | Spring Data Commons - Remote Code Execution |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
Spring Data Commons SpEL injection via MapDataBinder request parameter names. The Process rule (with /bin/* and /usr/* listed) blocks the Runtime.exec every public exploit makes. An expression that reads or changes data directly in Java, without starting a program, is not stopped.
How to mitigate CVE-2018-1273
Upgrade the affected software to a release that fixes it: 1.13.11 or 2.0.6. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Communications / Studio (Spring Data Commons) (22.2.0) Oracle HealthCare Applications / FHIR Server (Spring Data Commons) (8.1.0.0-8.1.3.1) |
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Financial Services Applications / Studio (Spring Data Commons) (8.0.8.2.0, 8.0.8.3.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Studio (Spring Data Commons) | 22.2.0 | 22.2.0 |
| Oracle Financial Services Applications | Studio (Spring Data Commons) | 8.0.8.2.0, 8.0.8.3.0 | 8.0.8.2.0 · 8.0.8.3.0 |
| Oracle HealthCare Applications | FHIR Server (Spring Data Commons) | 8.1.0.0-8.1.3.1 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.springframework.data:spring-data-commons |
1.13.0 | 1.13.11 |
unbounded |
org.springframework.data:spring-data-commons |
2.0.0 | 2.0.6 |
unbounded |
Products and versions
6 products, 13 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | ignite | generic | 1.0.0 · 1.0.0:rc3 · ≥ 1.0.1 and ≤ 2.5.0 |
| nvd | broadcom | spring data commons | generic | ≤ 1.12.10 · ≥ 1.13.0 and ≤ 1.13.10 · ≥ 2.0.0 and ≤ 2.0.5 |
| nvd | oracle | financial services crime and compliance management studio | generic | 8.0.8.2.0 · 8.0.8.3.0 |
| osv | org.springframework.data | spring-data-commons | generic | ≥ 1.13.0 and ＜ 1.13.11 · ≥ 2.0.0 and ＜ 2.0.6 |
| nvd | pivotal software | spring data rest | generic | ≥ 3.0.0 and ≤ 3.0.5 |
| nvd | vmware | spring data rest | generic | ≤ 2.5.10 · ≥ 2.6.0 and ≤ 2.6.10 |
References
Timeline
Timeline
| Published | 2018-04-11 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2019-01-08 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2022-03-25 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-08-26 | NVD's own last-modified date for this record. |
| Last VRT activity | 2026-09-29 | Most recent commit touching this CVE's classification, patch or rule file. |
| VulnCheck KEV: latest evidence | 2026-11-12 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |