GHSA-5xm9-rf63-wj7h

ghsaUSosv

Improper Control of Generation of Code in Spring Security

view advisory published 2022-05-17Licence: CC-BY-4.0

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2011-2732US	medium4.3	4.65% (92nd)	Exploit	2012-12-05
CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP…

references

External citations — patches, advisories, analysis.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814WEB
http://support.springsource.com/security/cve-2011-2732WEB
https://github.com/spring-projects/spring-securityPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2011-2732ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan