CVE-2011-2731: Race Condition
Published Dec 5, 2012
·Updated
Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
Affected Software
15 affected components
VMware SpringSource Spring Security=3.0.0
VMware SpringSource Spring Security=3.0.2
VMware SpringSource Spring Security=2.0.3
VMware SpringSource Spring Security<=3.0.5
VMware SpringSource Spring Security<=2.0.6
VMware SpringSource Spring Security=2.0.5
VMware SpringSource Spring Security=2.0.2
VMware SpringSource Spring Security=2.0.0
VMware SpringSource Spring Security=3.0.3
VMware SpringSource Spring Security=2.0.1
VMware SpringSource Spring Security=3.0.1
VMware SpringSource Spring Security=2.0.4
VMware SpringSource Spring Security=3.0.4
IBM Engineering Requirements Management DOORS and DOORS Web Access<=9.7.2.1 - 9.7.2.11
IBM Engineering Requirements Management DOORS and DOORS Web Access<=9.6.1.1 - 9.6.1.13
Event History
Dec 5, 2012
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Jul 6, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2011-2731?
CVE-2011-2731 has a high severity due to its potential for privilege escalation.
2
How do I fix CVE-2011-2731?
To fix CVE-2011-2731, upgrade VMware SpringSource Spring Security to version 2.0.7 or 3.0.6 or later.
3
What versions of VMware Spring Security are affected by CVE-2011-2731?
CVE-2011-2731 affects VMware Spring Security versions up to and including 2.0.6 and 3.0.5.
4
Can CVE-2011-2731 be exploited remotely?
Yes, CVE-2011-2731 can be exploited remotely by an attacker with malicious crafted threads.
5
What is the nature of the vulnerability in CVE-2011-2731?
CVE-2011-2731 is a race condition vulnerability that allows attackers to gain elevated privileges.