Pivotal Software Spring Data Rest vulnerabilities

4 CVEs affecting Pivotal Software Spring Data Rest, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1259, published 2018-05-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1273: VMware Tanzu Spring Data Commons Property Binder Vulnerability, published 2018-04-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 97% chance of exploitation in the next 30 days. Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An…
CVE-2017-8046, published 2018-01-04. Critical severity, CVSS 9.8. EPSS: 74.5% chance of exploitation in the next 30 days. Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use…
CVE-2018-1259, published 2018-05-11. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper…
CVE-2018-1274, published 2018-04-18. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated…