CVE-2018-1273: Spring Data Commons property binder allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 with unauthenticated network RCE, KEV listing with known ransomware use, and near-maximum EPSS probability make this an urgent patching priority.

What it is

Spring Data Commons fails to properly neutralize special elements in request parameters, allowing crafted input to be bound to object properties. This property binder flaw affects versions prior to 1.13.10, 2.0 to 2.0.5, and older unsupported releases, and it matters because it enables unauthenticated remote code execution on affected Spring Data REST-backed endpoints.

Impact

An unauthenticated attacker can execute arbitrary code on the server, leading to full compromise of confidentiality, integrity and availability.

Attack surface

Reached over the network by sending specially crafted request parameters to Spring Data REST-backed HTTP resources or via projection-based request payload binding. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Listed in CISA KEV since 2022-03-25 with known ransomware campaign use, and EPSS 30-day probability is 0.97002 (percentile 0.99888), indicating active exploitation.

What to do

• Upgrade Spring Data Commons to a fixed release (1.13.11 or later in the 1.13 line, 2.0.6 or later in the 2.0 line) per the vendor advisory.
• Apply the Oracle CPU July 2022 patches for affected Oracle products that bundle the vulnerable library.
• Where immediate patching is not possible, restrict or disable Spring Data REST projection-based request payload binding and filter untrusted request parameters.
• Monitor CISA KEV guidance and apply updates per vendor instructions by the listed due date.
• Inventory applications using Spring Data Commons to identify remaining unpatched instances.

Detection

• Inspect HTTP request parameters for class/property binding patterns such as class.module or similar property-path manipulation targeting Spring Data endpoints.
• Alert on unexpected outbound connections or process spawning from Java application servers hosting Spring Data REST.
• Search web and application logs for anomalous parameter names or values sent to Spring Data REST-backed resources.
• Correlate endpoint telemetry with known exploitation attempts against Spring Data Commons property binding.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.