#VU75519 Allocation of Resources Without Limits or Throttling in Pivotal Spring Data Commons and Pivotal Spring Data REST - CVE-2018-1274

Vulnerability identifier: #VU75519

Vulnerability risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-1274

CWE-ID: CWE-770

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Pivotal Spring Data Commons
Server applications / Frameworks for developing and running applications
Pivotal Spring Data REST
Server applications / Frameworks for developing and running applications

Vendor: Pivotal

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in the property path parser, caused by unlimited resource allocation. A remote attacker can send specially crafted HTTP requests to the application and consume all available CPU and memory resources.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Pivotal Spring Data Commons: 1.13 - 2.0.6

Pivotal Spring Data REST: 2.6.0 - 2.6.10, 3.0.0 - 3.0.5

---

External links
https://pivotal.io/security/cve-2018-1274
https://www.securityfocus.com/bid/103769
https://www.oracle.com/security-alerts/cpujul2022.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.