Vulnerability identifier: #VU75519

Vulnerability risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1274

CWE-ID: CWE-770

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Pivotal Spring Data Commons
Server applications / Frameworks for developing and running applications
Pivotal Spring Data REST
Server applications / Frameworks for developing and running applications

Vendor: Pivotal

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in the property path parser, caused by unlimited resource allocation. A remote attacker can send specially crafted HTTP requests to the application and consume all available CPU and memory resources.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Pivotal Spring Data Commons: 1.13 - 2.0.6

Pivotal Spring Data REST: 3.0.0 - 3.0.5, 2.6.0 - 2.6.10

---

External links
http://pivotal.io/security/cve-2018-1274
http://www.securityfocus.com/bid/103769
http://www.oracle.com/security-alerts/cpujul2022.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.