CVE-2011-2894

Vmware Spring Framework < 3.0.5 - Insecure Deserialization

Title source: rule
STIX 2.1

Description

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.

Exploits (1)

nomisec WORKING POC 44 stars
by pwntester · poc
https://github.com/pwntester/SpringBreaker

References (8)

Core 8
Core References
Vendor Advisory x_refsource_confirm
http://www.springsource.com/security/cve-2011-2894
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/49536
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/519593/100/0/threaded
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1334.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/69687
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/8405
Broken Link vdb-entry x_refsource_osvdb
http://osvdb.org/75263

Scores

EPSS 0.0200
EPSS Percentile 83.8%

Details

CWE
CWE-502
Status published
Products (4)
org.springframework/spring-core 3.0.0 - 3.0.6Maven
org.springframework.security/spring-security-core 3.0.0 - 3.0.6Maven
vmware/spring_framework 3.0.0 - 3.0.5
vmware/spring_security 2.0.0 - 2.0.6
Published Oct 04, 2011
Tracked Since Feb 18, 2026