GitHub Advisoryadvisory · Maven

GHSA-4644-hg35-55m9 Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

MEDIUM Published 2022-05-17 Modified 2022-07-13 Official page ↗
Aliases
CVE-2011-2731
Ecosystem
Maven
Packages
org.springframework.security:spring-security-core
Severity
Moderate
Weaknesses
CWE-362
Reviewed
2022-07-13

Affected packages

• Maven org.springframework.security:spring-security-core: < 2.0.7 → fixed in 2.0.7 • Maven org.springframework.security:spring-security-core: >= 3.0.0, < 3.0.6 → fixed in 3.0.6

Description

Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

Related

Alias · CVE (1)

  • CVE-2011-2731 Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the… vulnerability

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References