CVE-2011-2732
Spring Security - HTTP Header Injection
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
Vulnerabilidad de inyección de secuencias CRLF en la funcionalidad de logout en VMware SpringSource Spring Security antes de v2.0.7 y v3.0.x antes de v3.0.6 permite a atacantes remotos inyectar cabeceras HTTP de su elección y llevar a cabo ataques de división de respuesta HTTP a través del parámetro spring-security-redirect.
Spring Security allows the use of a parameter (named "spring-security-redirect" by default) to determine the location URL to which a user will be redirected after logging in. This will normally be submitted as part of the login request, so is deemed to be an acceptable use of remote supplied data. However, the functionality is in a base class which is also shared by logout code, so a logout URL could be maliciously constructed to contain a version of this parameter which contained CRLF characters in order to inject additional headers or split the response. Versions 2.0.0 to 2.0.6 and 3.0.0 to 3.0.5 are affected.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2011-07-11 CVE Reserved
- 2011-09-09 CVE Published
- 2011-09-09 First Exploit
- 2024-08-06 CVE Updated
- 2024-09-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814 | X_refsource_misc |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/36130 | 2011-09-09 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://support.springsource.com/security/cve-2011-2732 | 2012-12-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | <= 2.0.6 Search vendor "Vmware" for product "Springsource Spring Security" and version " <= 2.0.6" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | <= 3.0.5 Search vendor "Vmware" for product "Springsource Spring Security" and version " <= 3.0.5" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | 2.0.0 Search vendor "Vmware" for product "Springsource Spring Security" and version "2.0.0" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | 2.0.1 Search vendor "Vmware" for product "Springsource Spring Security" and version "2.0.1" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | 2.0.2 Search vendor "Vmware" for product "Springsource Spring Security" and version "2.0.2" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | 2.0.3 Search vendor "Vmware" for product "Springsource Spring Security" and version "2.0.3" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | 2.0.4 Search vendor "Vmware" for product "Springsource Spring Security" and version "2.0.4" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | 2.0.5 Search vendor "Vmware" for product "Springsource Spring Security" and version "2.0.5" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | 3.0.0 Search vendor "Vmware" for product "Springsource Spring Security" and version "3.0.0" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | 3.0.1 Search vendor "Vmware" for product "Springsource Spring Security" and version "3.0.1" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | 3.0.2 Search vendor "Vmware" for product "Springsource Spring Security" and version "3.0.2" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | 3.0.3 Search vendor "Vmware" for product "Springsource Spring Security" and version "3.0.3" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Springsource Spring Security Search vendor "Vmware" for product "Springsource Spring Security" | 3.0.4 Search vendor "Vmware" for product "Springsource Spring Security" and version "3.0.4" | - |
Affected
| ||||||