Lucene search

[email protected]NVD:CVE-2018-1274

HistoryApr 18, 2018 - 4:29 p.m.

CVE-2018-1274

2018-04-1816:29:00

CWE-770

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.004

Percentile

74.3%

JSON

Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).

Affected configurations

Nvd

Node

pivotal_softwarespring_data_commonsRange1.13–1.13.10

pivotal_softwarespring_data_commonsRange2.0–2.0.5

Node

pivotal_softwarespring_data_restRange2.6–2.6.10

pivotal_softwarespring_data_restRange3.0–3.0.5

VendorProductVersionCPE
pivotal_softwarespring_data_commons*cpe:2.3:a:pivotal_software:spring_data_commons:*:*:*:*:*:*:*:*
pivotal_softwarespring_data_rest*cpe:2.3:a:pivotal_software:spring_data_rest:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pivotal_software	spring_data_commons	*	cpe:2.3:a:pivotal_software:spring_data_commons::::::::
pivotal_software	spring_data_rest	*	cpe:2.3:a:pivotal_software:spring_data_rest::::::::