CVE-2011-2732
published 2012-12-05CVE-2011-2732: CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to…
PriorityP427medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
4.61%
90.6th percentile
CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | springsource_spring_security | <= 2.0.6 | — |
| vmware | springsource_spring_security | <= 3.0.5 | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
| vmware | springsource_spring_security | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Control of Generation of Code in Spring Security
ghsa·2022-05-17
CVE-2011-2732 [MEDIUM] CWE-94 Improper Control of Generation of Code in Spring Security
Improper Control of Generation of Code in Spring Security
CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
OSV
Improper Control of Generation of Code in Spring Security
osv·2022-05-17
CVE-2011-2732 [MEDIUM] Improper Control of Generation of Code in Spring Security
Improper Control of Generation of Code in Spring Security
CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
Red Hat
Security: Header injection flaw due improper use of 'spring-security-redirect' parameter
vendor_redhat·2011-09-09·CVSS 4.3
CVE-2011-2732 [MEDIUM] Security: Header injection flaw due improper use of 'spring-security-redirect' parameter
Security: Header injection flaw due improper use of 'spring-security-redirect' parameter
CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
Statement: Not vulnerable. This issue affects the Spring Security package, which is not shipped with any Red Hat products.
Package: unspecified (Red Hat JBoss BRMS 5) - Not affected
No detection rules found.
2012-12-05
Published