What’s Vulnerable › Vulnerabilities

CVE-2018-1259

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-05-11 · updated 2026-06-26
• Weakness: CWE-611

Description

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.

Affected products

• Spring Data Commons: from 1.13 through 1.13.11; from 2.0 through 2.0.6
• Pivotal Software Spring Data Rest: from 3.0 through 3.0.6
• Spring Data REST: from 2.6 (excl.) through 2.6.11
• Xmlbeam: through 1.4.14
• Pivotal Spring Data Commons: from 1.13 prior through 1.13.12; 2.0 prior to 2.0.7

References

• https://access.redhat.com/errata/RHSA-2018:1809
• https://access.redhat.com/errata/RHSA-2018:3768
• https://pivotal.io/security/cve-2018-1259
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://access.redhat.com/errata/RHSA-2018:1809
• https://access.redhat.com/errata/RHSA-2018:3768
• https://pivotal.io/security/cve-2018-1259
• https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2018-1259 or the next vulnerability affects your stack