GHSA-3295-h9qx-r82x

ghsaUSosv

Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

view advisory published 2022-05-14Licence: CC-BY-4.0

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2010-3700US	medium5.0OT elevated	1.69% (77th)	—	2010-10-29
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, al…

references

External citations — patches, advisories, analysis.

https://issues.apache.org/bugzilla/show_bug.cgi?id=25015WEB
https://nvd.nist.gov/vuln/detail/CVE-2010-3700ADVISORY
https://web.archive.org/web/20110802082343/http://www.springsource.com/security/cve-2010-3700WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan