CVEvulnerability

CVE-2011-2731

5.1 MEDIUM Published 2012-12-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-12-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.1 MEDIUM — AV:N/AC:H/Au:N/C:P/I:P/A:P
Weaknesses
CWE-362

Description

Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

Affected configurations

• vmware springsource spring security (<= 2.0.6) • vmware springsource spring security (<= 3.0.5) • vmware springsource spring security 2.0.0 • vmware springsource spring security 2.0.1 • vmware springsource spring security 2.0.2 • vmware springsource spring security 2.0.3 • vmware springsource spring security 2.0.4 • vmware springsource spring security 2.0.5 • vmware springsource spring security 3.0.0 • vmware springsource spring security 3.0.1 • vmware springsource spring security 3.0.2 • vmware springsource spring security 3.0.3 • vmware springsource spring security 3.0.4

Related

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References