CVE-2011-2894
mediumpriority · track · 40EPSS 0.086 · 95 %ileexploit · PoCEUUSEPSS · scored 2026-10-27
Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedRed Hat JBoss SOA Platform 5.1redhat_csaf
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise SOA Platform installation (including its databases, applications, configuration files, and so on). If you have created custom applications that are packaged with a copy of the Spring Framework 3 library, those applications must be rebuilt with the Spring Framework 3 files provided by this update. Note that it is recommended to halt the JBoss Enterprise SOA Platform server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the JBoss Enterprise SOA Platform server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2011:1334
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.1–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- pwntester/SpringBreakerExploit PoC for Spring RCE issue (CVE-2011-2894)PoC · poc_in_github
affected products (7)
Products and version ranges known to be affected.
- Maven org.springframework.security:spring-security-core2.0.0 → 2.0.7osvUSpkg:maven/org.springframework.security/spring-security-core
- Maven org.springframework.security:spring-security-core3.0.0 → 3.0.6osvUSpkg:maven/org.springframework.security/spring-security-core
advisories (2)
Vendor and ecosystem advisories describing this.
- RHSA-2011:1334Red Hat Security Advisory: JBoss Enterprise SOA Platform 5.1.0 security update2011-09-22csaf · redhat_csafUS
Updated Spring Framework 3 files for JBoss Enterprise SOA Platform 5.1.0 that fix multiple security issues are now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
- GHSA-f866-m9mv-2xr3Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data2022-05-14ghsa · osvUS
Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (24)
External citations — patches, advisories, analysis.
- http://osvdb.org/75263cnnvd
- http://securityreason.com/securityalert/8405cnnvd
- http://www.redhat.com/support/errata/RHSA-2011-1334.htmlcnnvd
- http://www.securityfocus.com/archive/1/519593/100/0/threadedcnnvd
- http://www.springsource.com/security/cve-2011-2894cnnvd
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69687cnnvd
- https://web.archive.org/web/20120307233721/cnnvd
- https://www.securityfocus.com/bid/49536cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan