What is GHSA-3295-h9qx-r82x?

GHSA-3295-h9qx-r82x is a security advisory published by GitHub Security Advisories with Medium severity. Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

Which CVE IDs does GHSA-3295-h9qx-r82x cover?

GHSA-3295-h9qx-r82x covers the following CVE IDs: CVE-2010-3700. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-3295-h9qx-r82x?

GHSA-3295-h9qx-r82x affects 3 products, including: maven/org.springframework.security:spring-security-core:\u003e= 2.0.0, \u003c 2.0.6; maven/org.springframework.security:spring-security-core:\u003e= 3.0.0, \u003c 3.0.4; maven/org.acegisecurity:acegi-security:\u003e= 1.0.0, \u003c= 1.0.7.

GHSA-3295-h9qx-r82xMedium

Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

March 6, 2023

🔗 CVE IDs covered (1)

CVE-2010-3700 →

📋 Description

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

🎯 Affected products3

maven/org.springframework.security:spring-security-core:>= 2.0.0, < 2.0.6
maven/org.springframework.security:spring-security-core:>= 3.0.0, < 3.0.4
maven/org.acegisecurity:acegi-security:>= 1.0.0, <= 1.0.7

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2010-3700
https://issues.apache.org/bugzilla/show_bug.cgi?id=25015
https://web.archive.org/web/20110802082343/http://www.springsource.com/security/cve-2010-3700
https://github.com/advisories/GHSA-3295-h9qx-r82x