GitHub Advisoryadvisory · Maven

GHSA-5xm9-rf63-wj7h Improper Control of Generation of Code in Spring Security

MEDIUM Published 2022-05-17 Modified 2022-07-13 Official page ↗
Aliases
CVE-2011-2732
Ecosystem
Maven
Packages
org.springframework.security:spring-security-core
Severity
Moderate
Weaknesses
CWE-94
Reviewed
2022-07-13

Affected packages

• Maven org.springframework.security:spring-security-core: < 2.0.7 → fixed in 2.0.7 • Maven org.springframework.security:spring-security-core: >= 3.0.0, < 3.0.6 → fixed in 3.0.6

Description

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

Related

Alias · CVE (1)

  • CVE-2011-2732 CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References