CVE-2011-2732: Code Injection
CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for the CRLF injection issue in VMware SpringSource Spring Security?
The vulnerability ID is CVE-2011-2732.
What is the severity of CVE-2011-2732?
CVE-2011-2732 is considered a high severity vulnerability due to its potential for HTTP response splitting attacks.
How do I fix CVE-2011-2732?
To fix CVE-2011-2732, upgrade VMware SpringSource Spring Security to version 2.0.7 or 3.0.6 or later.
Which versions of VMware SpringSource Spring Security are affected by CVE-2011-2732?
Versions 2.0.0 to 2.0.6 and 3.0.0 to 3.0.5 of VMware SpringSource Spring Security are affected by CVE-2011-2732.
Can CVE-2011-2732 allow remote attackers to conduct malicious actions?
Yes, CVE-2011-2732 allows remote attackers to inject arbitrary HTTP headers, which could lead to various types of attacks.