Deserialization in VMware Spring Framework
CVE-2011-2894
Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
Vulnerability class: Insecure Deserialization
EPSS: 0.085 (94.5th percentile) — read the EPSS interpretation.
Affected products
- Vmware Spring_framework
- Vmware Spring_security
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
- secalert@redhat.com (Third Party Advisory, x_refsource_SREASON, third-party-advisory)
- secalert@redhat.com (x_refsource_OSVDB, vdb-entry, Broken Link)
- secalert@redhat.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2011-2894?
- CVE-2011-2894 is a vulnerability in VMware Spring Framework, classified under Deserialization of Untrusted Data. Published 2011-10-04.
- Is CVE-2011-2894 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.