Lucene search

DellCVE-2018-1259

HistoryMay 11, 2018 - 8:29 p.m.

CVE-2018-1259

2018-05-1120:29:00

CWE-611

dell

web.nvd.nist.gov

cve-2018-1259

spring data commons

xmlbeam

vulnerability

file access

security advisory

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

0.004

Percentile

72.6%

JSON

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data’s projection-based request payload binding to access arbitrary files on the system.

Affected configurations

Nvd

Node

pivotal_softwarespring_data_commonsRange1.13–1.13.11

pivotal_softwarespring_data_commonsRange2.0–2.0.6

Node

pivotal_softwarespring_data_restRange2.6–2.6.11

pivotal_softwarespring_data_restRange3.0–3.0.6

Node

xmlbeamxmlbeamRange≤1.4.14

VendorProductVersionCPE
pivotal_softwarespring_data_commons*cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:*
pivotal_softwarespring_data_rest*cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*
xmlbeamxmlbeam*cpe:2.3:a:xmlbeam:xmlbeam:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pivotal_software	spring_data_commons	*	cpe:2.3:a:pivotal_software:spring_data_commons::::::::
pivotal_software	spring_data_rest	*	cpe:2.3:a:pivotal_software:spring_data_rest::::::::
xmlbeam	xmlbeam	*	cpe:2.3:a:xmlbeam:xmlbeam::::::::

CNA Affected

[
  {
    "product": "Spring Data Commons",
    "vendor": "Pivotal",
    "versions": [
      {
        "status": "affected",
        "version": "1.13 prior to 1.13.12; 2.0 prior to 2.0.7"
      }
    ]
  }
]