Published: 29/10/2010 Updated: 10/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

VMware SpringSource Spring Security 2.x prior to 2.0.6 and 3.x prior to 3.0.4, and Acegi Security 1.0.0 up to and including 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote malicious users to bypass security constraints via a path parameter.

Vulnerable Product	Search on Vulmon	Subscribe to Product
vmware springsource_spring_security 2.0.4
vmware springsource_spring_security 2.0.3
acegisecurity acegi-security 1.0.4
acegisecurity acegi-security 1.0.5
vmware springsource_spring_security 2.0.0
vmware springsource_spring_security 2.0.5
acegisecurity acegi-security 1.0.2
acegisecurity acegi-security 1.0.3
vmware springsource_spring_security 3.0.0
vmware springsource_spring_security 3.0.1
vmware springsource_spring_security 2.0.2
vmware springsource_spring_security 2.0.1
acegisecurity acegi-security 1.0.6
acegisecurity acegi-security 1.0.7
vmware springsource_spring_security 3.0.2
vmware springsource_spring_security 3.0.3
acegisecurity acegi-security 1.0.0
acegisecurity acegi-security 1.0.1
ibm websphere_application_server 7.0
ibm websphere_application_server 6.1

Spring Security does not consider URL path parameters when processing security constraints By adding an URL path parameter to a request, an attacker may be able to bypass a security constraint The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification (see below) Some Servlet containe ...

CWE-264 https://issues.apache.org/bugzilla/show_bug.cgi?id=25015 http://www.securityfocus.com/bid/44496 http://osvdb.org/68931 http://www.springsource.com/security/cve-2010-3700 http://secunia.com/advisories/42024 http://www.securityfocus.com/archive/1/514517/100/0/threaded https://nvd.nist.gov https://packetstormsecurity.com/files/95231/Spring-Security-Security-Constraint-Bypass.html

CVE-2010-3700

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect