CVE Vulnerability

CVE-2018-1259

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://pivotal.io/security/cve-2018-1259 Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1809 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3768 Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Configurations

Configuration 1

cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*
cpe:2.3:a:xmlbeam:xmlbeam:*:*:*:*:*:*:*:*
Information

Published : 2018-05-11 08:29

Updated : 2022-07-25 06:15

NVD link : CVE-2018-1259

Mitre link : CVE-2018-1259

Products Affected
No products.
CWE
CWE-611

Improper Restriction of XML External Entity Reference