Description

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

Remediation

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814

http://support.springsource.com/security/cve-2011-2732

Related Vulnerabilities

CVE-2019-1003022 Vulnerability in maven package org.jvnet.hudson.plugins:monitoring

CVE-2022-34817 Vulnerability in maven package de.einsundeins.jenkins.plugins.failedjobdeactivator:failedjobdeactivator

CVE-2023-39152 Vulnerability in maven package org.jenkins-ci.plugins:gradle

CVE-2020-2163 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2019-13173 Vulnerability in maven package org.webjars:fstream

Severity

Critical

Classification

CWE-94

Tags

Vendor Advisory