CVE-2011-2894

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/49536	Third Party Advisory VDB Entry
http://www.springsource.com/security/cve-2011-2894	Vendor Advisory
http://osvdb.org/75263	Broken Link
http://www.redhat.com/support/errata/RHSA-2011-1334.html	Third Party Advisory
http://securityreason.com/securityalert/8405	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/69687	Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/519593/100/0/threaded	Third Party Advisory VDB Entry
https://web.archive.org/web/20120307233721/http://www.springsource.com/security/cve-2011-2894

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vmware:spring_security::::::::
	cpe:2.3:a:vmware:spring_framework::::::::

Information

Published : 2011-10-04 03:55

Updated : 2022-07-17 13:15

NVD link : CVE-2011-2894

Mitre link : CVE-2011-2894

JSON object : View

CWE

CWE-502

Deserialization of Untrusted Data

Advertisement

Products Affected

vmware

spring_security
spring_framework

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/49536", "name": "49536", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.springsource.com/security/cve-2011-2894", "name": "http://www.springsource.com/security/cve-2011-2894", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://osvdb.org/75263", "name": "75263", "tags": ["Broken Link"], "refsource": "OSVDB"}, {"url": "http://www.redhat.com/support/errata/RHSA-2011-1334.html", "name": "RHSA-2011:1334", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "http://securityreason.com/securityalert/8405", "name": "8405", "tags": ["Third Party Advisory"], "refsource": "SREASON"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69687", "name": "spring-framework-object-sec-bypass(69687)", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/519593/100/0/threaded", "name": "20110909 CVE-2011-2894: Spring Framework and Spring Security serialization-based remoting vulnerabilities", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BUGTRAQ"}, {"url": "https://web.archive.org/web/20120307233721/http://www.springsource.com/security/cve-2011-2894", "name": "https://web.archive.org/web/20120307233721/http://www.springsource.com/security/cve-2011-2894", "tags": [], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-502"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-2894", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2011-10-04T10:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.0.6", "versionStartIncluding": "2.0.0"}, {"cpe23Uri": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.0.5", "versionStartIncluding": "3.0.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-07-17T20:15Z"}