Spring Framework表达式语言JSP属性处理信息泄露漏洞(cve-2011-2730)

🗓️ 13 Sep 2011 00:00:00Reported by RootType

Spring Framework表达式语言JSP属性处理信息泄露漏洞(cve-2011-2730). Apache许可证. 求值漏洞

Reporter	Title	Published	Views	Family All 64
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found on thirdparty libraries used by IBM® MobileFirst Platform	26 Jan 202317:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Directory Integrator is affected by multiple security vulnerabilities	22 Jun 202316:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities	18 Feb 201914:10	–	ibm
CVE	CVE-2011-2730	5 Dec 201217:00	–	cve
Cvelist	CVE-2011-2730	5 Dec 201217:00	–	cvelist
Debian	[SECURITY] [DSA 2504-1] libspring-2.5-java security update	28 Jun 201218:10	–	debian
Tenable Nessus	Debian DSA-2504-1 : libspring-2.5-java - information disclosure	29 Jun 201200:00	–	nessus
Tenable Nessus	RHEL 6 : JBoss EAP (RHSA-2013:0191)	24 Jan 201300:00	–	nessus
Tenable Nessus	RHEL 5 : JBoss EAP (RHSA-2013:0192)	24 Jan 201300:00	–	nessus
Tenable Nessus	RHEL 4 : JBoss EAP (RHSA-2013:0193)	24 Jan 201300:00	–	nessus


                                                向包含如下代码的页面：
&lt;spring:message code=&quot;${param['message']}&quot; text=&quot;&quot;/&gt;
提交如下形式的请求：
http:///vulnerable.com/foo?message=${applicationScope}
会输出包含classpath，本地工作目录，会话ID等服务器信息。

13 Sep 2011 00:00Current

6Medium risk

Vulners AI Score6

EPSS0.46306

spring framework jsp属性处理信息泄露 cve-2011-2730 apache许可证求值漏洞表达式语言