VMware Spring Security 2.0.0 Milestone 2

CPE Details

VMware Spring Security 2.0.0 Milestone 2
vmware
spring_security
2.0.0
2021-06-30
16h37 +00:00
2021-06-30
22h02 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:vmware:spring_security:2.0.0:milestone2:*:*:*:*:*:*

Informations

Vendor

vmware

Product

spring_security

Version

2.0.0

Update

milestone2

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2022-22978 2022-05-18 22h00 +00:00 In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
9.8
Critique
CVE-2011-2894 2011-10-04 08h00 +00:00 Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
6.8