Resource exhaustion in Broadcom Spring Data Commons
CVE-2018-1274
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.019 (79.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 79th percentile — 79.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.019 · newest: 0.019 · change: -0.000
Affected products
- Broadcom Spring Data Commons
- Pivotal Software Spring Data Rest
- Spring By Pivotal Framework — versions Versions 1.13 to 1.13.10, 2.0 to 2.0.5
- VMware Spring Data Rest
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securityfocus.com/bid/103769 (vdb-entry, Broken Link)
- www.oracle.com/security-alerts/cpujul2022.html (Third Party Advisory)
- pivotal.io/security/cve-2018-1274 (Vendor Advisory)
Frequently asked questions
- What is CVE-2018-1274?
- CVE-2018-1274 is a high-severity vulnerability in Broadcom Spring Data Commons, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2018-04-18.
- How severe is CVE-2018-1274?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2018-1274 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.