7.5

CVE-2011-2730

EPSS 11.78%
Veröffentlicht 05.12.2012 17:55:01
Zuletzt bearbeitet 16.06.2026 23:31:53
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 22

NVD 17 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Springsource ≫ Spring Framework Version <= 2.5.7_sr01

Springsource ≫ Spring Framework Version <= 3.0.5

Springsource ≫ Spring Framework Version2.5.0

Springsource ≫ Spring Framework Version2.5.0 Updaterc1

Springsource ≫ Spring Framework Version2.5.0 Updaterc2

Springsource ≫ Spring Framework Version2.5.1

Springsource ≫ Spring Framework Version2.5.2

Springsource ≫ Spring Framework Version2.5.3

Springsource ≫ Spring Framework Version2.5.4

Springsource ≫ Spring Framework Version2.5.5

Springsource ≫ Spring Framework Version2.5.6

Springsource ≫ Spring Framework Version2.5.7

Springsource ≫ Spring Framework Version3.0.0

Springsource ≫ Spring Framework Version3.0.1

Springsource ≫ Spring Framework Version3.0.2

Springsource ≫ Spring Framework Version3.0.3

Springsource ≫ Spring Framework Version3.0.4

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	11.78%	0.955

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://rhn.redhat.com/errata/RHSA-2013-0191.html

http://rhn.redhat.com/errata/RHSA-2013-0192.html

http://rhn.redhat.com/errata/RHSA-2013-0193.html

http://rhn.redhat.com/errata/RHSA-2013-0194.html

http://rhn.redhat.com/errata/RHSA-2013-0195.html

http://rhn.redhat.com/errata/RHSA-2013-0196.html

http://rhn.redhat.com/errata/RHSA-2013-0197.html

http://rhn.redhat.com/errata/RHSA-2013-0198.html

http://rhn.redhat.com/errata/RHSA-2013-0221.html

http://rhn.redhat.com/errata/RHSA-2013-0533.html

http://secunia.com/advisories/51984

http://secunia.com/advisories/52054

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814

http://secunia.com/advisories/55155

http://support.springsource.com/security/cve-2011-2730

Vendor Advisory

http://www.debian.org/security/2012/dsa-2504

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://www.securitytracker.com/id/1029151

https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit

https://nvd.nist.gov/vuln/detail/CVE-2011-2730

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2011-2730

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2011-2730

EUVD