CVE-2018-1259
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
Vulnerability in Spring Data Commons (versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7) used with XMLBeam 1.4.14 or earlier, results from improper restriction of XML external entity references. An unauthenticated remote attacker can send specially crafted request parameters to access arbitrary files on the system via projection-based request payload binding.
Risk Assessment
The risk is the ability for an unauthenticated attacker to read arbitrary files from the server, potentially leading to leakage of sensitive data such as configurations, passwords, or user data.
Recommendation
Immediately update Spring Data Commons to version 1.13.12 or 2.0.7 or later, and also update XMLBeam to a version newer than 1.4.14.
Original NVD description (English source)
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.