Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-f866-m9mv-2xr3
Advisory ID github_osv/GHSA-f866-m9mv-2xr3
Aliases CVE-2011-2894
Summary Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-502 Deserialization of Untrusted Data
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://osvdb.org/75263
http://securityreason.com/securityalert/8405
https://exchange.xforce.ibmcloud.com/vulnerabilities/69687
https://github.com/spring-projects/spring-framework
https://github.com/spring-projects/spring-framework/commit/070a723ef2c886770a063eb9a67f84f74e06edfb
http://www.securityfocus.com/archive/1/519593/100/0/threaded
http://www.securityfocus.com/bid/49536
CVE-2011-2894 https://nvd.nist.gov/vuln/detail/CVE-2011-2894
CVE-2011-2894 https://web.archive.org/web/20120307233721/http://www.springsource.com/security/cve-2011-2894
CVE-2011-2894 http://www.springsource.com/security/cve-2011-2894
RHSA-2011-1334.html http://www.redhat.com/support/errata/RHSA-2011-1334.html
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.