What is CVE-2011-2732?

CVE-2011-2732 is a vulnerability in Vmware Springsource Spring Security, classified under Code Injection. Published 2012-12-05.

Is CVE-2011-2732 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Vmware Springsource Spring Security

CVE-2011-2732

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.046 (90.7th percentile) — read the EPSS interpretation.

Affected products

Vmware Springsource_spring_security — versions 2.0.0, 2.0.1, 2.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

shoucheng3/spring-projects__spring-security_CVE-2011-2732_2-0-6-RELEASE

References

secalert@redhat.com (x_refsource_MISC)
secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2011-2732?: CVE-2011-2732 is a vulnerability in Vmware Springsource Spring Security, classified under Code Injection. Published 2012-12-05.
Is CVE-2011-2732 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.