CVE-2011-2732: Code Injection
First published: Wed Dec 05 2012(Updated: )
CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Spring Security | =3.0.0 | |
| VMware Spring Security | =3.0.2 | |
| VMware Spring Security | =2.0.3 | |
| VMware Spring Security | <=3.0.5 | |
| VMware Spring Security | <=2.0.6 | |
| VMware Spring Security | =2.0.5 | |
| VMware Spring Security | =2.0.2 | |
| VMware Spring Security | =2.0.0 | |
| VMware Spring Security | =3.0.3 | |
| VMware Spring Security | =2.0.1 | |
| VMware Spring Security | =3.0.1 | |
| VMware Spring Security | =2.0.4 | |
| VMware Spring Security | =3.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for the CRLF injection issue in VMware SpringSource Spring Security?
The vulnerability ID is CVE-2011-2732.
What is the severity of CVE-2011-2732?
CVE-2011-2732 is considered a high severity vulnerability due to its potential for HTTP response splitting attacks.
How do I fix CVE-2011-2732?
To fix CVE-2011-2732, upgrade VMware SpringSource Spring Security to version 2.0.7 or 3.0.6 or later.
Which versions of VMware SpringSource Spring Security are affected by CVE-2011-2732?
Versions 2.0.0 to 2.0.6 and 3.0.0 to 3.0.5 of VMware SpringSource Spring Security are affected by CVE-2011-2732.
Can CVE-2011-2732 allow remote attackers to conduct malicious actions?
Yes, CVE-2011-2732 allows remote attackers to inject arbitrary HTTP headers, which could lead to various types of attacks.
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/vmware
- canonical/vmware spring security
- version/vmware spring security/3.0.0
- version/vmware spring security/3.0.2
- version/vmware spring security/2.0.3
- version/vmware spring security/3.0.5
- version/vmware spring security/2.0.6
- version/vmware spring security/2.0.5
- version/vmware spring security/2.0.2
- version/vmware spring security/2.0.0
- version/vmware spring security/3.0.3
- version/vmware spring security/2.0.1
- version/vmware spring security/3.0.1
- version/vmware spring security/2.0.4
- version/vmware spring security/3.0.4