VIR Vulnerability Intelligence Relay

CVE-2011-2732

medium
Published 2012-12-05 · Modified 2024-12-07
CVSS v3
—
CVSS v2
4.3
VIR risk
4.3

Description

Improper Control of Generation of Code in Spring Security

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — http://support.springsource.com/security/cve-2011-2732

Package impact
EcosystemPackageVulnerableFixed
java Mavenorg.springframework.security:spring-security-core<2.0.72.0.7
java Mavenorg.springframework.security:spring-security-core>=3.0.0,<3.0.63.0.6

Application impact
VendorProductVersionsFixed
vmware vmwarespringsource_spring_security{"endIncluding":"2.0.6"}
vmware vmwarespringsource_spring_security2.0.0
vmware vmwarespringsource_spring_security2.0.1
vmware vmwarespringsource_spring_security2.0.2
vmware vmwarespringsource_spring_security2.0.3
vmware vmwarespringsource_spring_security2.0.4
vmware vmwarespringsource_spring_security2.0.5
vmware vmwarespringsource_spring_security3.0.0
vmware vmwarespringsource_spring_security3.0.1
vmware vmwarespringsource_spring_security3.0.2
vmware vmwarespringsource_spring_security3.0.3
vmware vmwarespringsource_spring_security3.0.4

References

CWEs

CWE-94

Verify integrity in audit chain (admin only). AS-IS.