What is GHSA-5xm9-rf63-wj7h?

GHSA-5xm9-rf63-wj7h is a security advisory published by GitHub Security Advisories with Medium severity. Improper Control of Generation of Code in Spring Security

Which CVE IDs does GHSA-5xm9-rf63-wj7h cover?

GHSA-5xm9-rf63-wj7h covers the following CVE IDs: CVE-2011-2732. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-5xm9-rf63-wj7h?

GHSA-5xm9-rf63-wj7h affects 2 products, including: maven/org.springframework.security:spring-security-core:\u003c 2.0.7; maven/org.springframework.security:spring-security-core:\u003e= 3.0.0, \u003c 3.0.6.

GHSA-5xm9-rf63-wj7hMedium

Improper Control of Generation of Code in Spring Security

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2011-2732 →

📋 Description

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

🎯 Affected products2

maven/org.springframework.security:spring-security-core:< 2.0.7
maven/org.springframework.security:spring-security-core:>= 3.0.0, < 3.0.6

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2011-2732
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814
http://support.springsource.com/security/cve-2011-2732
https://github.com/advisories/GHSA-5xm9-rf63-wj7h