Vulnerability Details : CVE-2018-1274
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
Vulnerability category: Denial of service
Products affected by CVE-2018-1274
- Pivotal Software » Spring Data RestVersions from including (>=) 2.6 and up to, including, (<=) 2.6.10cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*
- Pivotal Software » Spring Data RestVersions from including (>=) 3.0 and up to, including, (<=) 3.0.5cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*
- Pivotal Software » Spring Data CommonsVersions from including (>=) 2.0 and up to, including, (<=) 2.0.5cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:*
- Pivotal Software » Spring Data CommonsVersions from including (>=) 1.13 and up to, including, (<=) 1.13.10cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-1274
0.97%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 75 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-1274
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2018-1274
-
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-1274
-
https://pivotal.io/security/cve-2018-1274
CVE-2018-1274: Denial of Service with Spring Data | Security | PivotalVendor Advisory
-
http://www.securityfocus.com/bid/103769
Multiple Pivotal Products CVE-2018-1274 Denial of Service VulnerabilityThird Party Advisory;VDB Entry
-
https://www.oracle.com/security-alerts/cpujul2022.html
Oracle Critical Patch Update Advisory - July 2022
Jump to