Login Request a demo
High severity · published May 11, 2018
CVE-2018-1259
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability…
7.5
CVSS
4.8%
EPSS
No
On KEV
Description
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Spring Data Commons · Broadcom
1.13 through 1.13.11; 2.0 through 2.0.6 · source: NVD
SD
Spring Data Rest · Pivotal Software
3.0 through 3.0.6 · source: NVD
XM
Xmlbeam · Xmlbeam
through 1.4.14 · source: NVD
Affected product
SD
Spring Data Commons
Broadcom
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1259
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1259
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1809
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3768
Vendor Advisory
https://pivotal.io/security/cve-2018-1259
www.oracle.com
https://www.oracle.com/security-alerts/cpujul2022.html
More from Spring Data Commons
9.8
CVE-2018-1273
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of…
7.5
CVE-2026-41716
Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names
7.5
CVE-2026-41695
Denial of Service in Spring Data Commons Property Path Resolution
7.5
CVE-2018-1274
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation
5.9
CVE-2026-41721
Spring Data Commons Denial of Service via Data Binding