exploit the possibilities
Showing 1 - 1 of 1 RSS Feed

Files

Spring Security Security Constraint Bypass
Posted Oct 28, 2010
Authored by SpringSource Security Team

Spring Security does not consider URL path parameters when processing security constraints. By adding an URL path parameter to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification (see below). Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed.

tags | exploit, root, bypass
advisories | CVE-2010-3700
MD5 | 39d52137898c5484e3318915ce5f0839
Page 1 of 1
Back1Next

Top Authors In Last 30 Days

Recent News

News RSS Feed
Medical Records For 24.3 Million Left Exposed
Posted Sep 18, 2019

tags | headline, privacy, usa, data loss, fraud
New Algorithms Aim To Stamp Out Abuse On Twitter
Posted Sep 18, 2019

tags | headline, fraud, twitter
Poor Protocol Design For IoT Devices Fueling DDoS
Posted Sep 18, 2019

tags | headline, denial of service, flaw
Novaestrat Exec Arrested After Ecuadorian Data Leak
Posted Sep 18, 2019

tags | headline, government, privacy, data loss
Alleged JPMorgan Hacker Set To Plead Guilty
Posted Sep 17, 2019

tags | headline, hacker, bank
The Air Force Will Let Hackers Try To Hijack An Orbiting Satellite
Posted Sep 17, 2019

tags | headline, hacker, usa, conference, military
Gootkit Crew Left Database Exposed Without A Password
Posted Sep 17, 2019

tags | headline, malware, database, data loss, fraud
Attackers Pose As Business Executives To Secure Security Certificates
Posted Sep 17, 2019

tags | headline, cybercrime, fraud, cryptography
Personal Data From Entire 16.6M Population Of Ecuador Leaked Online
Posted Sep 16, 2019

tags | headline, privacy, data loss
Uber Confirms Account Takeover Vulnerability
Posted Sep 16, 2019

tags | headline, hacker, privacy, flaw
View More News →
packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close