# CVE-2018-1273: Spring Data Commons remote code injection vulnerability

Source: https://junglewise.ai/threats/cve-2018-1273-vmware-tanzu-spring-data-commons-property-binder-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-10-17. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2018-1273 · Severity: critical · CVSS 3 · Exploited in the wild · Published 2018-10-17

Spring Data Commons contains a property binder vulnerability due to improper neutralization of special elements. An unauthenticated remote attacker can use specially crafted request parameters against Spring Data REST backed HTTP resources or projection-based request payload binding to achieve remote code execution.

Technologies: [org.springframework.data:spring-data-commons (Maven)](https://junglewise.ai/threats/technologies/org-springframework-data-spring-data-commons). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2018-1273 exploited in the wild?** Yes. CVE-2018-1273 is known to be exploited in the wild, first recorded on 25 March 2022. Treat it as urgent.

**How severe is CVE-2018-1273?** Critical severity, with a CVSS score of 3, published 17 October 2018.

**Which products and versions are affected?** org.springframework.data:spring-data-commons (Maven) ECOSYSTEM:introduced=1.13.0,fixed=1.13.11.

**Is there a fix for CVE-2018-1273?** Yes. org.springframework.data:spring-data-commons (Maven): upgrade to 1.13.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-1273 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2018-1273?** Check whether you run org.springframework.data:spring-data-commons (Maven) or VMware Tanzu Spring Data Commons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.data:spring-data-commons (Maven): upgrade to 1.13.11 or later

  ```sh
  # set org.springframework.data:spring-data-commons to 1.13.11 in your pom.xml or build.gradle
  ```


## Affected products

- VMware Tanzu Spring Data Commons prior to 1.13.11, 2.0 to 2.0.6, and older unsupported versions
- VMware Tanzu Spring Data REST up to 2.5.10, 2.6.0 to 2.6.10, 3.0.0 to 3.0.5
- Apache Ignite 1.0.0 to 2.5.0

## Identifiers

- CVE-2018-1273
- GHSA-4fq3-mr56-cg6r

## Timeline

- 2022-03-25: kev added: Added to CISA's Known Exploited Vulnerabilities Catalog.
- 2022-03-25: disclosed

## Related threats

- [VMware Spring Data Commons denial of service in @ProjectedPayload](https://junglewise.ai/threats/cve-2026-41721-vmware-spring-data-commons-denial-of-service-in-projectedpayload)
- [VMware Spring Data heap exhaustion in property-lookup cache](https://junglewise.ai/threats/cve-2026-41716-vmware-spring-data-heap-exhaustion-in-property-lookup-cache)
- [VMware Spring Data Commons DoS in Sort parameter parsing](https://junglewise.ai/threats/cve-2026-41711-vmware-spring-data-commons-dos-in-sort-parameter-parsing)
- [VMware Spring Data Commons denial of service in MappingContext](https://junglewise.ai/threats/cve-2026-41695-vmware-spring-data-commons-denial-of-service-in-mappingcontext)
- [Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation](https://junglewise.ai/threats/cve-2018-1274-spring-data-commons-contain-a-property-path-parser-vulnerability)