CVE-2018-1274
HighCVSS 7.5Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
Vulnerability in Spring Data Commons (versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions) due to unlimited resource allocation during property path parsing. An unauthenticated attacker can send requests to Spring Data REST endpoints or endpoints using property path parsing, causing denial of service (high CPU and memory consumption).
Risk Assessment
The risk is the possibility of a remote, unauthenticated attacker performing a DoS attack, potentially leading to application unavailability and infrastructure overload.
Recommendation
Immediately upgrade Spring Data Commons to version 1.13.11, 2.0.6, or later. If upgrading is not possible, restrict access to REST endpoints and implement rate limiting mechanisms.
Other vulnerabilities in Spring Data Commons (wersje 1.13 do 1.13.10, 2.0 do 2.0.5 oraz starsze nieobsługiwane)
Original NVD description (English source)
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS