Spring Data Commons remote code injection vulnerability
Critical severity
GitHub Reviewed
Published
Oct 17, 2018
to the GitHub Advisory Database
•
Updated Mar 20, 2024
Package
Affected versions
>= 1.13.0, < 1.13.11
>= 2.0.0, < 2.0.6
Patched versions
1.13.11
2.0.6
Description
Published by the National Vulnerability Database
Apr 11, 2018
Published to the GitHub Advisory Database
Oct 17, 2018
Reviewed
Jun 16, 2020
Last updated
Mar 20, 2024
Credits
-
sharonbz Analyst
-
MarkLee131 Analyst
-
r3kumar Analyst
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding that can lead to a remote code execution attack.
References