GHSA-4644-hg35-55m9

ghsaUSosv

Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

view advisory published 2022-05-17Licence: CC-BY-4.0

Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2011-2731US	medium5.1	1.26% (69th)	—	2012-12-05
Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security cont…

references

External citations — patches, advisories, analysis.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814WEB
http://support.springsource.com/security/cve-2011-2731WEB
https://github.com/spring-projects/spring-securityPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2011-2731ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan