Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HApache Ignite
APPApache1.0.01.0.1 – 2.5.0Broadcom Spring Data Commons
APPBroadcom1.13.0 – 1.13.102.0.0 – 2.0.5≤ 1.12.10Oracle Financial Services Crime And Compliance Management Studio
APPOracle8.0.8.2.08.0.8.3.0Pivotal Software Spring Data Rest
APPPivotal Software3.0.0 – 3.0.5VMware Spring Data Rest
APPVmware2.6.0 – 2.6.10≤ 2.5.10
CISA KEV — detailsi
- Vendori
- VMware Tanzu
- Producti
- Spring Data Commons
- Added to KEVi
- March 25, 2022
- Remediation deadline (US Federal)i
- April 15, 2022(overdue)
- Ransomwarei
- Active ransomware campaigns exploit this vulnerability
Apply updates per vendor instructions.
Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.
Related vulnerabilities
Apache Ignite: pominięcie filtrów deserializacji umożliwia RCE
Obejście autoryzacji w Spring Security przez RegexRequestMatcher
Apache Shiro — authentication bypass w integracji ze Spring Boot
Apache Ignite — nieautoryzowany dostęp do systemu plików przez funkcje SQL H2
Apache Ignite: RCE przez niebezpieczną deserializację obiektów Java