DATABASE RESOURCES PRICING ABOUT US

{"id": "SECURITYVULNS:DOC:27010", "bulletinFamily": "software", "title": "CVE-2011-2732: Spring Security header injection vulnerability", "description": "CVE-2011-2732: Spring Security header injection vulnerability\r\n\r\nSeverity: Important\r\n\r\nVersions Affected:\r\n 2.0.0 to 2.0.6\r\n 3.0.0 to 3.0.5\r\nEarlier versions may also be affected\r\n\r\nDescription:\r\nSpring Security allows the use of a parameter (named "spring-security-redirect" by default) to determine the location URL to which a user will be redirected after logging in. This will normally be submitted as part of the login request, so is deemed to be an acceptable use of remote supplied data. However, the functionality is in a base class which is also shared by logout code, so a logout URL could be maliciously constructed to contain a version of this parameter which contained CRLF characters in order to inject additional headers or split the response.\r\n\r\nExample:\r\nA logout link such as\r\n/mywebapp/logout/spring-security-redirect=%0d%0a%20NewHeader%3ainjectedValue\r\ncould be used to inject the header\r\nNewHeader:InjectedValue\r\nto the response\r\n\r\nMitigation:\r\nAnyone using Spring Security's default logout handling support may be vulnerable, unless they are using a custom LogoutSuccessHandler which does not support this parameter.\r\nAll users may mitigate this issue by upgrading to 3.0.6\r\nUsers of 2.0.x may upgrade to 2.0.7\r\n\r\nFix:\r\nSupport for the use of the parameter has been disabled by default for logout handling in 3.0.6. A default response wrapper has also been used which will raise an exception if the value passed to HttpResponse.sendRedirect contains CR or LF characters.\r\n\r\nCredit:\r\nThe issue was discovered by David Mas.\r\n\r\nHistory:\r\n2011-09-09: Original advisory\r\n\r\nReferences:\r\n[1] http://www.springsource.com/security/cve-2011-2732", "published": "2011-09-13T00:00:00", "modified": "2011-09-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:27010", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2011-2732"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:41", "edition": 1, "viewCount": 26, "enchantments": {"score": {"value": -0.7, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2011-2732"]}, {"type": "github", "idList": ["GHSA-5XM9-RF63-WJ7H"]}, {"type": "osv", "idList": ["OSV:GHSA-5XM9-RF63-WJ7H"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:104946"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:11900"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2011-2732"]}]}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2011-2732"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:104946"]}]}, "exploitation": null, "vulnersScore": -0.7}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1660012827, "score": 1659909920}, "_internal": {"score_hash": "155d52d7e9b17e8b9e7f68380a8c7035"}}

{"packetstorm": [{"lastseen": "2016-12-05T22:21:34", "description": "", "cvss3": {}, "published": "2011-09-09T00:00:00", "type": "packetstorm", "title": "Spring Security Header Injection", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2011-2732"], "modified": "2011-09-09T00:00:00", "id": "PACKETSTORM:104946", "href": "https://packetstormsecurity.com/files/104946/Spring-Security-Header-Injection.html", "sourceData": "`CVE-2011-2732: Spring Security header injection vulnerability \n \nSeverity: Important \n \nVersions Affected: \n2.0.0 to 2.0.6 \n3.0.0 to 3.0.5 \nEarlier versions may also be affected \n \nDescription: \nSpring Security allows the use of a parameter (named \"spring-security-redirect\" by default) to determine the location URL to which a user will be redirected after logging in. This will normally be submitted as part of the login request, so is deemed to be an acceptable use of remote supplied data. However, the functionality is in a base class which is also shared by logout code, so a logout URL could be maliciously constructed to contain a version of this parameter which contained CRLF characters in order to inject additional headers or split the response. \n \nExample: \nA logout link such as \n/mywebapp/logout/spring-security-redirect=%0d%0a%20NewHeader%3ainjectedValue \ncould be used to inject the header \nNewHeader:InjectedValue \nto the response \n \nMitigation: \nAnyone using Spring Security's default logout handling support may be vulnerable, unless they are using a custom LogoutSuccessHandler which does not support this parameter. \nAll users may mitigate this issue by upgrading to 3.0.6 \nUsers of 2.0.x may upgrade to 2.0.7 \n \nFix: \nSupport for the use of the parameter has been disabled by default for logout handling in 3.0.6. A default response wrapper has also been used which will raise an exception if the value passed to HttpResponse.sendRedirect contains CR or LF characters. \n \nCredit: \nThe issue was discovered by David Mas. \n \nHistory: \n2011-09-09: Original advisory \n \nReferences: \n[1] http://www.springsource.com/security/cve-2011-2732 \n`\n", "sourceHref": "https://packetstormsecurity.com/files/download/104946/CVE-2011-2732.txt", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "ubuntucve": [{"lastseen": "2022-08-04T14:27:16", "description": "CRLF injection vulnerability in the logout functionality in VMware\nSpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows\nremote attackers to inject arbitrary HTTP headers and conduct HTTP response\nsplitting attacks via the spring-security-redirect parameter.\n\n#### Bugs\n\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670901>\n", "cvss3": {}, "published": "2012-12-05T00:00:00", "type": "ubuntucve", "title": "CVE-2011-2732", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2732"], "modified": "2012-12-05T00:00:00", "id": "UB:CVE-2011-2732", "href": "https://ubuntu.com/security/CVE-2011-2732", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "cve": [{"lastseen": "2022-03-23T12:15:11", "description": "CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.", "cvss3": {}, "published": "2012-12-05T17:55:00", "type": "cve", "title": "CVE-2011-2732", "cwe": ["CWE-94"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2732"], "modified": "2012-12-06T05:00:00", "cpe": ["cpe:/a:vmware:springsource_spring_security:3.0.2", "cpe:/a:vmware:springsource_spring_security:3.0.4", "cpe:/a:vmware:springsource_spring_security:2.0.1", "cpe:/a:vmware:springsource_spring_security:3.0.5", "cpe:/a:vmware:springsource_spring_security:3.0.3", "cpe:/a:vmware:springsource_spring_security:2.0.2", "cpe:/a:vmware:springsource_spring_security:2.0.4", "cpe:/a:vmware:springsource_spring_security:2.0.5", "cpe:/a:vmware:springsource_spring_security:2.0.6", "cpe:/a:vmware:springsource_spring_security:3.0.0", "cpe:/a:vmware:springsource_spring_security:3.0.1", "cpe:/a:vmware:springsource_spring_security:2.0.3", "cpe:/a:vmware:springsource_spring_security:2.0.0"], "id": "CVE-2011-2732", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2732", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:vmware:springsource_spring_security:3.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:vmware:springsource_spring_security:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:vmware:springsource_spring_security:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:vmware:springsource_spring_security:2.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:vmware:springsource_spring_security:2.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:vmware:springsource_spring_security:3.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:vmware:springsource_spring_security:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:vmware:springsource_spring_security:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:vmware:springsource_spring_security:2.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:vmware:springsource_spring_security:2.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:vmware:springsource_spring_security:2.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:vmware:springsource_spring_security:2.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:vmware:springsource_spring_security:3.0.3:*:*:*:*:*:*:*"]}], "osv": [{"lastseen": "2022-09-19T03:07:46", "description": "CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.", "cvss3": {}, "published": "2022-05-17T05:18:15", "type": "osv", "title": "Improper Control of Generation of Code in Spring Security", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2732"], "modified": "2022-09-19T02:59:41", "id": "OSV:GHSA-5XM9-RF63-WJ7H", "href": "https://osv.dev/vulnerability/GHSA-5xm9-rf63-wj7h", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "github": [{"lastseen": "2022-07-13T19:58:05", "description": "CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.", "cvss3": {}, "published": "2022-05-17T05:18:15", "type": "github", "title": "Improper Control of Generation of Code in Spring Security", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-2732"], "modified": "2022-07-13T17:56:39", "id": "GHSA-5XM9-RF63-WJ7H", "href": "https://github.com/advisories/GHSA-5xm9-rf63-wj7h", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "securityvulns": [{"lastseen": "2021-06-08T18:44:31", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "edition": 2, "cvss3": {}, "published": "2011-09-13T00:00:00", "title": "Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2011-2732", "CVE-2011-3357", "CVE-2011-3358", "CVE-2011-2730", "CVE-2011-2894", "CVE-2011-2731", "CVE-2011-3211"], "modified": "2011-09-13T00:00:00", "id": "SECURITYVULNS:VULN:11900", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:11900", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}