Sign In

CVE-2011-2730

ADVISORY - github

Summary

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

EPSS Score⁠: 0.46306 (0.977)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-16⁠

Configuration

ADVISORY - gitlab

CWE-1035⁠

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

CWE-16⁠

Configuration

CWE-937⁠

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

Impacted images

Advisories

GitHub

CREATED

UPDATED

ADVISORY IDGHSA-wv88-pf73-x22p⁠
EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh
PackageTypeOS NameOS VersionAffected RangesFix Versions
org.springframework/spring-coremaven--<=2.5.6.SEC022.5.6.SEC03
org.springframework/spring-coremaven-->=2.5.7.SR0,<=2.5.7.SR0222.5.7.SR023
org.springframework/spring-coremaven-->=3.0.0,<3.0.63.0.6

Severity and metrics

No CVSS data available from this advisory.

NIST

CREATED

UPDATED

ADVISORY IDCVE-2011-2730⁠
EXPLOITABILITY SCORE

10

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CWE-16⁠

CVSS SCORE

7.5high

Ubuntu

CREATED

UPDATED

ADVISORY IDCVE-2011-2730⁠
EXPLOITABILITY SCORE

-

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Alow

Red Hat

CREATED

UPDATED

ADVISORY IDCVE-2011-2730⁠
EXPLOITABILITY SCORE

10.0

EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

6.4high