PT-2012-1569 · Vmware Springsource · Spring Security

Published 2012-12-05 · Updated 2022-05-17 · CVE-2011-2732

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions VMware SpringSource Spring Security versions prior to 2.0.7 VMware SpringSource Spring Security versions 3.0.x prior to 3.0.6

Description The issue concerns a CRLF injection vulnerability in the logout functionality. This allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

Recommendations For versions prior to 2.0.7, update to version 2.0.7 or later. For versions 3.0.x prior to 3.0.6, update to version 3.0.6 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-2732

GHSA-5XM9-RF63-WJ7H

Affected Products

Spring Security

References · 6

• 🔥 https://exploit-db.com/exploits/36130 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-2732 · Security Note
• https://osv.dev/vulnerability/GHSA-5xm9-rf63-wj7h · Vendor Advisory
• http://support.springsource.com/security/cve-2011-2732 · Vendor Advisory
• https://github.com/spring-projects/spring-security · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814 · Note