Description

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

Remediation

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814

http://support.springsource.com/security/cve-2011-2732

Related Vulnerabilities

CVE-2019-1003055 Vulnerability in maven package org.jvnet.hudson.plugins:ftppublisher

CVE-2022-36882 Vulnerability in maven package org.jenkins-ci.plugins:git

CVE-2021-22119 Vulnerability in maven package org.springframework.security:spring-security-oauth2-client

CVE-2021-20222 Vulnerability in maven package org.keycloak:keycloak-core

CVE-2018-8032 Vulnerability in maven package org.apache.axis:axis

Severity

Critical

Classification

CWE-94

Tags

Vendor Advisory