pivotalsoftware spring-data-commons CVE-2018-1259 in Pivotal Software and Xmlbeam Products
Published on May 11, 2018

product logo product logo
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.

Vendor Advisory Vendor Advisory NVD


Products Associated with CVE-2018-1259

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2018-1259 are published in these products:

Pivotal Software Spring Data Commons
 
Pivotal Software Spring Data Rest
 
Xmlbeam
 

Affected Versions

Pivotal Spring Data Commons Version 1.13 prior to 1.13.12; 2.0 prior to 2.0.7 is affected by CVE-2018-1259

Exploit Probability

EPSS
9.83%
Percentile
92.83%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.