CVE-2011-2731
published 2012-12-05CVE-2011-2731: Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the…
PriorityP425medium5.1CVSS 2.0
AVNACHAuNCPIPAP
EPSS
1.25%
65.8th percentile
Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | springsource_spring_security | <= 2.0.6 | — |
| vmware | springsource_spring_security | <= 3.0.5 | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
CVSS provenance
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
vendor_redhat5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security
ghsa·2022-05-17
CVE-2011-2731 [MEDIUM] CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security
Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security
Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
OSV
Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security
osv·2022-05-17
CVE-2011-2731 [MEDIUM] Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security
Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security
Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
Red Hat
Security: Privilege escalation by using RunAsManager mechanism
vendor_redhat·2011-09-09·CVSS 5.1
CVE-2011-2731 [MEDIUM] Security: Privilege escalation by using RunAsManager mechanism
Security: Privilege escalation by using RunAsManager mechanism
Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
Statement: Not vulnerable. This issue affects the Spring Security package, which is not shipped with any Red Hat products.
Package: unspecified (Red Hat JBoss BRMS 5) - Not affected
No detection rules found.
No public exploits indexed.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814http://secunia.com/advisories/55155http://support.springsource.com/security/cve-2011-2731http://www.securitytracker.com/id/1029151http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814http://secunia.com/advisories/55155http://support.springsource.com/security/cve-2011-2731http://www.securitytracker.com/id/1029151
2012-12-05
Published