CVE-2018-1259

State: Published
Severity: Not scored
Published: May 11, 2018
Updated: Sep 16, 2024
Reserved: Dec 6, 2017

Description

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Spring Data CommonsPivotal	1.13 prior to 1.13.12; 2.0 prior to 2.0.7Affected

References

RHSA-2018:1809vendor-advisory
RHSA-2018:3768vendor-advisory
https://www.oracle.com/security-alerts/cpujul2022.html
https://pivotal.io/security/cve-2018-1259

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.