EXPOSURES › CVE-2018-1273

CVE-2018-1273

CRITICAL ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2022-03-25 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2018-1273 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 95/100 ransomwarerceexploited-in-wild

VMware Tanzu Spring Data Commons contained a remote code execution vulnerability actively exploited in ransomware attacks, impacting DIB organizations using this software stack.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

VMware Tanzu · vendor Spring Data Commons · product

DESCRIPTION

Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.

AFFECTED FEDRAMP PRODUCTS · 16

PRODUCT	PROVIDER	STATUS	MATCH
Aconex for Defense Oracle	Oracle	Authorized	vendor-exact · 0.90
Clarity Broadcom	Broadcom	Authorized	vendor-exact · 0.90
Federal Managed Cloud Services Oracle	Oracle	Authorized	vendor-exact · 0.90
Fusion Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
General Support Systems (GSS) Broadcom	Broadcom	Authorized	vendor-exact · 0.90
Government Cloud - Common Controls Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Cloud Infrastructure-Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) - Moderate Oracle	Oracle	In Process	vendor-exact · 0.90
Oracle Service Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Service Cloud (DOD) Oracle	Oracle	Authorized	vendor-exact · 0.90
Rally Broadcom	Broadcom	Authorized	vendor-exact · 0.90
Symantec Gov Cloud Security (GCS) Broadcom	Broadcom	In Process	vendor-exact · 0.90
Taleo Cloud - U.S. Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
VMware Government Services (VGS) VMware, Inc.	VMware, Inc.	Authorized	vendor-exact · 0.90
Workspace ONE VMware, Inc.	VMware, Inc.	Authorized	vendor-exact · 0.90