Critical · published April 11, 2018
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A sneaky property binder vulnerability is lurking in Spring Data Commons! An unauthenticated user can exploit it to execute remote code - that's a game changer for security! 🔥 Think of it like a restaurant where the chef prepares dishes without properly checking the ingredients submitted by customers — one rogue order could lead to a disastrous (and unauthorized) recipe being cooked! If left unaddressed, this vulnerability could allow attackers to gain control, running arbitrary code on your server. Imagine an intruder walking into your kitchen and cooking whatever they want, potentially causing chaos and leaking sensitive information!
Think of it like a restaurant where the chef prepares dishes without properly checking the ingredients submitted by customers — one rogue order could lead to a disastrous (and unauthorized) recipe being cooked! This vulnerability stems from improper neutralization of special elements in request parameters, allowing remote attackers to manipulate Spring Data REST backed HTTP resources and execute malicious code.
If left unaddressed, this vulnerability could allow attackers to gain control, running arbitrary code on your server. Imagine an intruder walking into your kitchen and cooking whatever they want, potentially causing chaos and leaking sensitive information! Immediately update Spring Data Commons to versions 1.13.10, 2.0.5, or newer. It's also crucial to review your application's input handling practices to ensure they're properly validating and sanitizing incoming data. You've got this! Follow these steps to secure your application and keep those nasty attackers at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| broadcom/spring_data_commons | ≤ 1.12.10 | — |
| broadcom/spring_data_commons | ≥ 1.13.0, ≤ 1.13.10 | — |
| broadcom/spring_data_commons | ≥ 2.0.0, ≤ 2.0.5 | — |
| pivotal_software/spring_data_rest | ≥ 3.0.0, ≤ 3.0.5 | — |
| vmware/spring_data_rest | ≤ 2.5.10 | — |
| vmware/spring_data_rest | ≥ 2.6.0, ≤ 2.6.10 | — |
| apache/ignite | ≥ 1.0.1, ≤ 2.5.0 | — |
| apache/ignite | all versions | — |
| apache/ignite | all versions | — |
| oracle/financial_services_crime_and_compliance_management_studio | all versions | — |
| oracle/financial_services_crime_and_compliance_management_studio | all versions | — |