Exploit for Deserialization of Untrusted Data in Vmware Spring_Framework

🗓️ 03 Nov 2025 18:38:29Reported by Brais202Type

Critical deserialization flaw in Java Store using unsafe XMLDecoder on user info cookie enabling unauthenticated remote code execution.

Reporter	Title	Published	Views	Family All 14
CVE	CVE-2011-2894	4 Oct 201110:00	–	cve
Cvelist	CVE-2011-2894	4 Oct 201110:00	–	cvelist
Github Security Blog	Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data	14 May 202202:54	–	github
NVD	CVE-2011-2894	4 Oct 201110:55	–	nvd
OSV	GHSA-F866-M9MV-2XR3 Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data	14 May 202202:54	–	osv
Prion	Deserialization of untrusted data	4 Oct 201110:55	–	prion
RedHat Linux	Important: Red Hat Security Advisory: JBoss Enterprise SOA Platform 5.1.0 security update	22 Sep 201116:54	–	redhat
RedHat Linux	Security: Chosen commands execution on the server (Framework) or authentication token bypass (Security) by objects de-serialization	22 Sep 201116:54	–	redhat
securityvulns	CVE-2011-2894: Spring Framework and Spring Security serialization-based remoting vulnerabilities	13 Sep 201100:00	–	securityvulns
securityvulns	Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)	13 Sep 201100:00	–	securityvulns