CVE-2011-2732 Improper Control of Generation of Code in Spring Security
MediumCVSS 4.3
EPSS 4.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework.security/spring-security-core(Maven) | < 2.0.7 | 2.0.7 |
| org.springframework.security/spring-security-core(Maven) | >= 3.0.0, < 3.0.6 | 3.0.6 |
| org.springframework.security/spring-security-core(Maven) | = 2.0.0 | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 2.0.1 | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 2.0.2 | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 2.0.3 | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 2.0.4 | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 2.0.5.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 2.0.6.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 3.0.0.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 3.0.1.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 3.0.2.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 3.0.3.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 3.0.4.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 3.0.5.RELEASE | No fix listed |
| VMware springsource spring security | <= 2.0.6 | No fix listed |
| VMware springsource spring security | <= 3.0.5 | No fix listed |
| VMware springsource spring security | = 2.0.0 | No fix listed |
| VMware springsource spring security | = 2.0.1 | No fix listed |
| VMware springsource spring security | = 2.0.2 | No fix listed |
| VMware springsource spring security | = 2.0.3 | No fix listed |
| VMware springsource spring security | = 2.0.4 | No fix listed |
| VMware springsource spring security | = 2.0.5 | No fix listed |
| VMware springsource spring security | = 3.0.0 | No fix listed |
| VMware springsource spring security | = 3.0.1 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware springsource spring security | = 3.0.2 | No fix listed |
| VMware springsource spring security | = 3.0.3 | No fix listed |
| VMware springsource spring security | = 3.0.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugs.debian.org
- support.springsource.com vendor-advisory
- github.com
- github.com product