Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-7kpg-9qh6-c7e6

Summary

Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

Aliases

alias	CVE-2010-3700

alias	GHSA-3295-h9qx-r82x

Fixed_packages

url pkg:maven/org.acegisecurity/acegi-security@1.0.7

purl pkg:maven/org.acegisecurity/acegi-security@1.0.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7kpg-9qh6-c7e6

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.acegisecurity/acegi-security@1.0.7

url pkg:maven/org.springframework.security/spring-security-core@2.0.6.RELEASE

purl pkg:maven/org.springframework.security/spring-security-core@2.0.6.RELEASE

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1ccn-qeh9-vqgn

vulnerability	VCID-28ru-qm8a-skg3

vulnerability	VCID-46dm-5t83-tyh6

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-p8md-ykt2-zyav

vulnerability	VCID-szph-1zgk-a7dt

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-vh4r-sk3t-eqe3

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@2.0.6.RELEASE

url pkg:maven/org.springframework.security/spring-security-core@3.0.4.RELEASE

purl pkg:maven/org.springframework.security/spring-security-core@3.0.4.RELEASE

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1ccn-qeh9-vqgn

vulnerability	VCID-28ru-qm8a-skg3

vulnerability	VCID-46dm-5t83-tyh6

vulnerability	VCID-aygn-9njz-ybfh

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-p8md-ykt2-zyav

vulnerability	VCID-szph-1zgk-a7dt

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-vh4r-sk3t-eqe3

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.4.RELEASE

Affected_packages

url pkg:maven/org.acegisecurity/acegi-security@1.0.0

purl pkg:maven/org.acegisecurity/acegi-security@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7kpg-9qh6-c7e6

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.acegisecurity/acegi-security@1.0.0

url pkg:maven/org.acegisecurity/acegi-security@1.0.1

purl pkg:maven/org.acegisecurity/acegi-security@1.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7kpg-9qh6-c7e6

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.acegisecurity/acegi-security@1.0.1

url pkg:maven/org.acegisecurity/acegi-security@1.0.2

purl pkg:maven/org.acegisecurity/acegi-security@1.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7kpg-9qh6-c7e6

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.acegisecurity/acegi-security@1.0.2

url pkg:maven/org.acegisecurity/acegi-security@1.0.3

purl pkg:maven/org.acegisecurity/acegi-security@1.0.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7kpg-9qh6-c7e6

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.acegisecurity/acegi-security@1.0.3

url pkg:maven/org.acegisecurity/acegi-security@1.0.4

purl pkg:maven/org.acegisecurity/acegi-security@1.0.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7kpg-9qh6-c7e6

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.acegisecurity/acegi-security@1.0.4

url pkg:maven/org.acegisecurity/acegi-security@1.0.6

purl pkg:maven/org.acegisecurity/acegi-security@1.0.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7kpg-9qh6-c7e6

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.acegisecurity/acegi-security@1.0.6

url pkg:maven/org.acegisecurity/acegi-security@1.0.7

purl pkg:maven/org.acegisecurity/acegi-security@1.0.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7kpg-9qh6-c7e6

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.acegisecurity/acegi-security@1.0.7

url pkg:maven/org.springframework.security/spring-security-core@2.0.0

purl pkg:maven/org.springframework.security/spring-security-core@2.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1ccn-qeh9-vqgn

vulnerability	VCID-28ru-qm8a-skg3

vulnerability	VCID-46dm-5t83-tyh6

vulnerability	VCID-7kpg-9qh6-c7e6

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-p8md-ykt2-zyav

vulnerability	VCID-szph-1zgk-a7dt

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-vh4r-sk3t-eqe3

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@2.0.0

url pkg:maven/org.springframework.security/spring-security-core@2.0.1

purl pkg:maven/org.springframework.security/spring-security-core@2.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1ccn-qeh9-vqgn

vulnerability	VCID-28ru-qm8a-skg3

vulnerability	VCID-46dm-5t83-tyh6

vulnerability	VCID-7kpg-9qh6-c7e6

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-p8md-ykt2-zyav

vulnerability	VCID-szph-1zgk-a7dt

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-vh4r-sk3t-eqe3

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@2.0.1

url pkg:maven/org.springframework.security/spring-security-core@2.0.2

purl pkg:maven/org.springframework.security/spring-security-core@2.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1ccn-qeh9-vqgn

vulnerability	VCID-28ru-qm8a-skg3

vulnerability	VCID-46dm-5t83-tyh6

vulnerability	VCID-7kpg-9qh6-c7e6

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-p8md-ykt2-zyav

vulnerability	VCID-szph-1zgk-a7dt

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-vh4r-sk3t-eqe3

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@2.0.2

url pkg:maven/org.springframework.security/spring-security-core@2.0.3

purl pkg:maven/org.springframework.security/spring-security-core@2.0.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1ccn-qeh9-vqgn

vulnerability	VCID-28ru-qm8a-skg3

vulnerability	VCID-46dm-5t83-tyh6

vulnerability	VCID-7kpg-9qh6-c7e6

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-p8md-ykt2-zyav

vulnerability	VCID-szph-1zgk-a7dt

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-vh4r-sk3t-eqe3

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@2.0.3

url pkg:maven/org.springframework.security/spring-security-core@2.0.4

purl pkg:maven/org.springframework.security/spring-security-core@2.0.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1ccn-qeh9-vqgn

vulnerability	VCID-28ru-qm8a-skg3

vulnerability	VCID-46dm-5t83-tyh6

vulnerability	VCID-7kpg-9qh6-c7e6

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-p8md-ykt2-zyav

vulnerability	VCID-szph-1zgk-a7dt

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-vh4r-sk3t-eqe3

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@2.0.4

url pkg:maven/org.springframework.security/spring-security-core@2.0.5.RELEASE

purl pkg:maven/org.springframework.security/spring-security-core@2.0.5.RELEASE

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1ccn-qeh9-vqgn

vulnerability	VCID-28ru-qm8a-skg3

vulnerability	VCID-46dm-5t83-tyh6

vulnerability	VCID-7kpg-9qh6-c7e6

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-p8md-ykt2-zyav

vulnerability	VCID-szph-1zgk-a7dt

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-vh4r-sk3t-eqe3

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@2.0.5.RELEASE

url pkg:maven/org.springframework.security/spring-security-core@3.0.0

purl pkg:maven/org.springframework.security/spring-security-core@3.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7kpg-9qh6-c7e6

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.0

url pkg:maven/org.springframework.security/spring-security-core@3.0.0.RELEASE

purl pkg:maven/org.springframework.security/spring-security-core@3.0.0.RELEASE

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1ccn-qeh9-vqgn

vulnerability	VCID-28ru-qm8a-skg3

vulnerability	VCID-46dm-5t83-tyh6

vulnerability	VCID-7kpg-9qh6-c7e6

vulnerability	VCID-aygn-9njz-ybfh

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-p8md-ykt2-zyav

vulnerability	VCID-szph-1zgk-a7dt

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-vh4r-sk3t-eqe3

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.0.RELEASE

url pkg:maven/org.springframework.security/spring-security-core@3.0.1.RELEASE

purl pkg:maven/org.springframework.security/spring-security-core@3.0.1.RELEASE

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1ccn-qeh9-vqgn

vulnerability	VCID-28ru-qm8a-skg3

vulnerability	VCID-46dm-5t83-tyh6

vulnerability	VCID-7kpg-9qh6-c7e6

vulnerability	VCID-aygn-9njz-ybfh

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-p8md-ykt2-zyav

vulnerability	VCID-szph-1zgk-a7dt

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-vh4r-sk3t-eqe3

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.1.RELEASE

url pkg:maven/org.springframework.security/spring-security-core@3.0.2.RELEASE

purl pkg:maven/org.springframework.security/spring-security-core@3.0.2.RELEASE

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1ccn-qeh9-vqgn

vulnerability	VCID-28ru-qm8a-skg3

vulnerability	VCID-46dm-5t83-tyh6

vulnerability	VCID-7kpg-9qh6-c7e6

vulnerability	VCID-aygn-9njz-ybfh

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-p8md-ykt2-zyav

vulnerability	VCID-szph-1zgk-a7dt

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-vh4r-sk3t-eqe3

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.2.RELEASE

url pkg:maven/org.springframework.security/spring-security-core@3.0.3.RELEASE

purl pkg:maven/org.springframework.security/spring-security-core@3.0.3.RELEASE

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1ccn-qeh9-vqgn

vulnerability	VCID-28ru-qm8a-skg3

vulnerability	VCID-46dm-5t83-tyh6

vulnerability	VCID-7kpg-9qh6-c7e6

vulnerability	VCID-aygn-9njz-ybfh

vulnerability	VCID-gmn5-ykw3-cqf4

vulnerability	VCID-m3ht-28wc-yyeg

vulnerability	VCID-p8md-ykt2-zyav

vulnerability	VCID-szph-1zgk-a7dt

vulnerability	VCID-uxfq-rj43-a7bd

vulnerability	VCID-vh4r-sk3t-eqe3

vulnerability	VCID-zb97-bzya-4uek

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.3.RELEASE

References

reference_url	http://osvdb.org/68931
reference_id
reference_type
scores
url	http://osvdb.org/68931

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2010-3700

reference_id

reference_type

scores

value	0.00248
scoring_system	epss
scoring_elements	0.4826
published_at	2026-06-08T12:55:00Z

value	0.00248
scoring_system	epss
scoring_elements	0.4824
published_at	2026-06-04T12:55:00Z

value	0.00248
scoring_system	epss
scoring_elements	0.48302
published_at	2026-06-05T12:55:00Z

value	0.00248
scoring_system	epss
scoring_elements	0.48306
published_at	2026-06-06T12:55:00Z

value	0.00248
scoring_system	epss
scoring_elements	0.48288
published_at	2026-06-07T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2010-3700

reference_url

https://issues.apache.org/bugzilla/show_bug.cgi?id=25015

reference_id

reference_type

scores

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://issues.apache.org/bugzilla/show_bug.cgi?id=25015

reference_url

https://web.archive.org/web/20110802082343/http://www.springsource.com/security/cve-2010-3700

reference_id

reference_type

scores

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://web.archive.org/web/20110802082343/http://www.springsource.com/security/cve-2010-3700

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2010-3700

reference_id

CVE-2010-3700

reference_type

scores

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2010-3700

reference_url	http://www.springsource.com/security/cve-2010-3700
reference_id	CVE-2010-3700
reference_type
scores
url	http://www.springsource.com/security/cve-2010-3700

reference_url

https://github.com/advisories/GHSA-3295-h9qx-r82x

reference_id

GHSA-3295-h9qx-r82x

reference_type

scores

value	MODERATE
scoring_system	cvssv3.1_qr
scoring_elements

url

https://github.com/advisories/GHSA-3295-h9qx-r82x

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	264
name	Permissions, Privileges, and Access Controls
description	Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	288
name	Authentication Bypass Using an Alternate Path or Channel
description	A product requires authentication, but the product has an alternate path or channel that does not require authentication.

Exploits

Severity_range_score 4.0 - 6.9

Exploitability 0.5

Weighted_severity 6.2

Risk_score 3.1

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7kpg-9qh6-c7e6

Vulnerability Instance