Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.springframework/spring-core@2.5.7.SR022
purl pkg:maven/org.springframework/spring-core@2.5.7.SR022
Tags Ghost
Next non-vulnerable version 5.2.24.RELEASE
Latest non-vulnerable version 6.2.11
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-h4ys-unzb-cbhn
Aliases:
CVE-2011-2730
GHSA-wv88-pf73-x22p
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
2.5.7.SR023
Affected by 0 other vulnerabilities.
3.0.6
Affected by 0 other vulnerabilities.
3.0.6.RELEASE
Affected by 13 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-04T14:31:17.951093+00:00 GHSA Importer Affected by VCID-h4ys-unzb-cbhn https://github.com/advisories/GHSA-wv88-pf73-x22p 38.1.0