CVE-2011-2894
First published: Tue Oct 04 2011(Updated: )
Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.springframework.security:spring-security-core | >=2.0.0<2.0.7 | 2.0.7 |
| maven/org.springframework.security:spring-security-core | >=3.0.0<3.0.6 | 3.0.6 |
| maven/org.springframework:spring-core | >=3.0.0<3.0.6 | 3.0.6 |
| Spring Framework | >=3.0.0<=3.0.5 | |
| VMware Spring Security | >=2.0.0<=2.0.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/49536
- http://www.springsource.com/security/cve-2011-2894
- http://osvdb.org/75263
- http://www.redhat.com/support/errata/RHSA-2011-1334.html
- http://securityreason.com/securityalert/8405
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69687
- http://www.securityfocus.com/archive/1/519593/100/0/threaded
- https://web.archive.org/web/20120307233721/http://www.springsource.com/security/cve-2011-2894
- https://nvd.nist.gov/vuln/detail/CVE-2011-2894
- https://github.com/spring-projects/spring-framework/commit/070a723ef2c886770a063eb9a67f84f74e06edfb
- https://github.com/advisories/GHSA-f866-m9mv-2xr3 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2011-2894?
CVE-2011-2894 has been rated as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2011-2894?
To fix CVE-2011-2894, upgrade Spring Framework to version 3.0.6 or Spring Security to version 2.0.7 or higher.
What software versions are affected by CVE-2011-2894?
CVE-2011-2894 affects Spring Framework versions 3.0.0 through 3.0.5 and Spring Security versions 2.0.0 through 2.0.6.
Can CVE-2011-2894 be exploited remotely?
Yes, CVE-2011-2894 can be exploited remotely by attackers to execute untrusted code.
What types of attacks are possible due to CVE-2011-2894?
CVE-2011-2894 allows attackers to bypass security restrictions and execute arbitrary code through deserialization of untrusted data.
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-f866-m9mv-2xr3
- alias/CVE-2011-2894
- agent/software-canonical-lookup
- agent/weakness
- agent/references
- agent/severity
- agent/softwarecombine
- agent/description
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-historical
- package-manager/maven
- vendor/vmware
- canonical/spring framework
- version/spring framework/3.0.0
- version/spring framework/3.0.5
- canonical/vmware spring security
- version/vmware spring security/2.0.0
- version/vmware spring security/2.0.6