VIR Vulnerability Intelligence Relay

CVE-2011-2730

high
Published 2012-12-05 · Modified 2024-12-05
CVSS v3
—
CVSS v2
7.5
VIR risk
7.5

Description

Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — http://support.springsource.com/security/cve-2011-2730

Package impact
EcosystemPackageVulnerableFixed
java Mavenorg.springframework:spring-core>=3.0.0,<3.0.63.0.6
java Mavenorg.springframework:spring-core<2.5.6.SEC032.5.6.SEC03
java Mavenorg.springframework:spring-core>=2.5.7.SR0,<2.5.7.SR0232.5.7.SR023

Application impact
VendorProductVersionsFixed
springsourcespring_framework{"endIncluding":"2.5.7_sr01"}
springsourcespring_framework2.5.0
springsourcespring_framework2.5.1
springsourcespring_framework2.5.2
springsourcespring_framework2.5.3
springsourcespring_framework2.5.4
springsourcespring_framework2.5.5
springsourcespring_framework2.5.6
springsourcespring_framework2.5.7
springsourcespring_framework3.0.0
springsourcespring_framework3.0.1
springsourcespring_framework3.0.2
springsourcespring_framework3.0.3
springsourcespring_framework3.0.4

References

CWEs

CWE-16

Verify integrity in audit chain (admin only). AS-IS.