CVE-2011-2894: Medium severity VMware Spring Framework vulnerability
Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.springframework.security:spring-security-coreto a version that resolves this vulnerability.Fixed in 2.0.7 - Upgrade
Upgrade
maven/org.springframework.security:spring-security-coreto a version that resolves this vulnerability.Fixed in 3.0.6 - Upgrade
Upgrade
maven/org.springframework:spring-coreto a version that resolves this vulnerability.Fixed in 3.0.6
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2894?
CVE-2011-2894 has been rated as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2011-2894?
To fix CVE-2011-2894, upgrade Spring Framework to version 3.0.6 or Spring Security to version 2.0.7 or higher.
What software versions are affected by CVE-2011-2894?
CVE-2011-2894 affects Spring Framework versions 3.0.0 through 3.0.5 and Spring Security versions 2.0.0 through 2.0.6.
Can CVE-2011-2894 be exploited remotely?
Yes, CVE-2011-2894 can be exploited remotely by attackers to execute untrusted code.
What types of attacks are possible due to CVE-2011-2894?
CVE-2011-2894 allows attackers to bypass security restrictions and execute arbitrary code through deserialization of untrusted data.