Spring Security provides a mechanism (RunAsManager) to allow particular operations to run with a different set of privileges than the predefined user. The implementation contains a race condition whereby the escalated privileges could also be used in a different invocation in another thread. Versions 2.0.0 to 2.0.6 and 3.0.0 to 3.0.5 are affected.
47b96c9de342642c2cd4e172c544b89e012a3797e75972454bb8c77cb5091e42Spring Framework versions 3.0.0 to 3.0.5 and Spring Security versions 2.0.0 to 2.0.6 and 3.0.0 to 3.0.5 suffer from serialization issues. Several issues have been reported which may affect applications which de-serialize objects from an untrusted source such as a remote client. It is possible for a malicious client to inject undesirable behavior into the server by serializing proxies rather than specific class instances, or by taking advantage of internal AOP interfaces which were being exposed through the remote service, in addition to the service interface.
f905e5bf5433c31b6e389d1aca05670a117b1f5976e8502215745fe22fe34fc4Spring Security allows the use of a parameter (named "spring-security-redirect" by default) to determine the location URL to which a user will be redirected after logging in. This will normally be submitted as part of the login request, so is deemed to be an acceptable use of remote supplied data. However, the functionality is in a base class which is also shared by logout code, so a logout URL could be maliciously constructed to contain a version of this parameter which contained CRLF characters in order to inject additional headers or split the response. Versions 2.0.0 to 2.0.6 and 3.0.0 to 3.0.5 are affected.
190a53655a53fda33bb5be21ed5b61b82d8ef40a6afea588925d6719c66f2ba0Spring Framework versions 3.0.0 to 3.0.5, 2.5.0 to 2.5.6.SEC02, and 2.5.0 to 2.5.7.SR01 suffer from an information disclosure vulnerability.
f0dc757e73d89236f2c88698d4791d1317a31be811db0b76dade2bee53c8a3d7VMware vFabric tc Server allows users to store the passwords used for JMX authentication in an obfuscated form for organizations where storing passwords in plain text is not permitted. The JMX authentication implementation was incorrectly allowing users to authenticate using the password in either its plain text form or its obfuscated form, bypassing the benefit of obfuscation. Versions 2.0.0.RELEASE to 2.0.5.SR01 and 2.1.0.RELEASE to 2.1.1.SR01 are affected.
a23ea5d133c5ea0c5b2775fefc4fcbc7cf7cf5fcd577cd7b417bb806221241f5Apache Shiro version 1.0.0-incubating suffers from an information disclosure vulnerability. Shiro's path-based filter chain mechanism did not normalize request paths before performing path-matching logic. The result is that Shiro filter chain matching logic was susceptible to potential path traversal attacks.
edbfc654a617fb75fdde37febf48f3584026969f760f1650e56dd5ba41ffad08Spring Security does not consider URL path parameters when processing security constraints. By adding an URL path parameter to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification (see below). Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed.
429e4cf5e844ee3703c922909bb8c267c6740efb53e7fb37de08a3f14ccacd09The SpringSource tc Server suffers from an unauthenticated remote access vulnerability in relation to the JMX interface.
d8837f97c98e36f3dfe3aaa8777b942e3480fd0ee9a2827b13650cfc14baeaa2SpringSource Hyperic HQ suffers from multiple stored cross site scripting vulnerability.
10513634324c50825e0c403f5eec29293c1318a9c53dd4584caab3a181828a8cSpringSource versions Hyperic HQ 3.2, 4.0, 4.1, and 4.2-beta1 suffer from a stored cross site scripting vulnerability.
cf606ddcc8f82d68dce7d9dc35eb9ecb409d12d529769c995e1498eabc1611ebSpringSource versions Hyperic HQ 3.2, 4.0, 4.1, and 4.2-beta1 suffer from a reflected cross site scripting vulnerability.
c64a153a6422c9754fa7f2877f9b124a2a88dc586ef80026cf60df594e722ae2
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed