Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CISA Catalog
Date Added
Due Date
Vulnerability Name
Required Action
2022-03-25
2022-04-15
VMware Tanzu Spring Data Commons Property Binder Vulnerability
Apply updates per vendor instructions.
Date Added: 2022-03-25
Due Date: 2022-04-15
Vulnerability Name: VMware Tanzu Spring Data Commons Property Binder Vulnerability
Required Action: Apply updates per vendor instructions.