Vulnerability CVE-2011-2732

Vulnerability CVE-2011-2732

Published: 2012-12-05

Description:

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

Type:

CWE-94

(Improper Control of Generation of Code ('Code Injection'))

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.3/10	2.9/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

Affected software
Vmware -> Springsource spring security

References:

http://support.springsource.com/security/cve-2011-2732

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814

Copyright 2024, cxsecurity.com