Vulnerability CVE-2011-2731

Vulnerability CVE-2011-2731

Published: 2012-12-05

Description:

Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

CVSS2 => (AV:N/AC:H/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
5.1/10	6.4/10	4.9/10

Exploit range	Attack complexity	Authentication
Remote	High	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Vmware -> Springsource spring security

References:

http://support.springsource.com/security/cve-2011-2731

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814

Copyright 2024, cxsecurity.com