Bug ID: 1578902
Summary: CVE-2018-1259 spring-framework: XXE with Spring Data’s
Product: Security Response
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7,
used in combination with XMLBeam 1.4.14 or earlier versions, contains a
property binder vulnerability caused by improper restriction of XML external
entity references as underlying library XMLBeam does not restrict external
reference expansion. An unauthenticated remote malicious user can supply
specially crafted request parameters against Spring Data's projection-based
request payload binding to access arbitrary files on the system.
You are receiving this mail because:
You are on the CC list for the bug.