CVE-2011-2730 Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework
HighCVSS 7.5
EPSS 11.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-core(Maven) | >= 3.0.0, < 3.0.6 | 3.0.6 |
| org.springframework/spring-core(Maven) | = 3.0.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | < 2.5.6.SEC03 | 2.5.6.SEC03 |
| org.springframework/spring-core(Maven) | = 1.0 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.0-rc1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.0.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1-rc1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1-rc2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.3 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.4 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2-rc1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2-rc2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.3 | No fix listed |
Show 51 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-core(Maven) | = 1.2.4 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.6 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.7 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.8 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.9 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m1 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m2 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m3 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m4 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m5 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-rc1 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-rc2 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.3 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.4 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.6 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.7 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.8 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.3 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.4 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.6 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.6.SEC01 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.6.SEC02 | No fix listed |
| org.springframework/spring-core(Maven) | >= 2.5.7.SR0, < 2.5.7.SR023 | 2.5.7.SR023 |
| org.springframework/spring-core(Maven) | <= 2.5.6.SEC02 | No fix listed |
| org.springframework/spring-core(Maven) | >= 2.5.7.SR0, <= 2.5.7.SR022 | No fix listed |
| springsource spring framework | <= 2.5.7_sr01 | No fix listed |
| springsource spring framework | <= 3.0.5 | No fix listed |
| springsource spring framework | = 2.5.0 | No fix listed |
| springsource spring framework | = 2.5.0-rc1 | No fix listed |
| springsource spring framework | = 2.5.0-rc2 | No fix listed |
| springsource spring framework | = 2.5.1 | No fix listed |
| springsource spring framework | = 2.5.2 | No fix listed |
| springsource spring framework | = 2.5.3 | No fix listed |
| springsource spring framework | = 2.5.4 | No fix listed |
| springsource spring framework | = 2.5.5 | No fix listed |
| springsource spring framework | = 2.5.6 | No fix listed |
| springsource spring framework | = 2.5.7 | No fix listed |
| springsource spring framework | = 3.0.0 | No fix listed |
| springsource spring framework | = 3.0.1 | No fix listed |
| springsource spring framework | = 3.0.2 | No fix listed |
| springsource spring framework | = 3.0.3 | No fix listed |
| springsource spring framework | = 3.0.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- docs.google.com
- github.com product
- bugs.debian.org
- RHSA-2013:0191 vendor-advisory
- RHSA-2013:0192 vendor-advisory
- RHSA-2013:0194 vendor-advisory
- RHSA-2013:0195 vendor-advisory
- RHSA-2013:0196 vendor-advisory
- RHSA-2013:0198 vendor-advisory
- RHSA-2013:0221 vendor-advisory
- RHSA-2013:0533 vendor-advisory
- DSA-2504 vendor-advisory
- www.oracle.com
- github.com
- RHSA-2013:0193 vendor-advisory
- RHSA-2013:0197 vendor-advisory
- 51984 third-party-advisory
- 52054 third-party-advisory
- 55155 third-party-advisory
- support.springsource.com vendor-advisory
- 1029151 vdb-entry