Vulnerability in Acegisecurity Acegi-Security
CVE-2010-3700
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
EPSS: 0.017 (74.4th percentile) — read the EPSS interpretation.
Affected products
- Acegisecurity Acegi-security — versions 1.0.1, 1.0.0, 1.0.5
- Ibm Websphere_application_server — versions 7.0, 6.1
- Vmware Springsource_spring_security — versions 2.0.5, 3.0.1, 2.0.3
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
- secalert@redhat.com (x_refsource_MISC)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_OSVDB, vdb-entry)
- secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ)