GitHub Advisoryadvisory · Maven

GHSA-3295-h9qx-r82x Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

MEDIUM Published 2022-05-14 Modified 2022-07-08 Official page ↗
Aliases
CVE-2010-3700
Ecosystem
Maven
Packages
org.springframework.security:spring-security-core, org.acegisecurity:acegi-security
Severity
Moderate
Weaknesses
CWE-288
Reviewed
2022-07-08

Affected packages

• Maven org.springframework.security:spring-security-core: >= 2.0.0, < 2.0.6 → fixed in 2.0.6 • Maven org.springframework.security:spring-security-core: >= 3.0.0, < 3.0.4 → fixed in 3.0.4 • Maven org.acegisecurity:acegi-security: >= 1.0.0, <= 1.0.7 (no fix yet)

Description

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

Related

Alias · CVE (1)

  • CVE-2010-3700 VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere… vulnerability

Weakness · CWE (1)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References