VMware Springsource Spring Security vulnerabilities

4 CVEs affecting VMware Springsource Spring Security, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-5055, published 2012-12-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-2732, published 2012-12-05. Medium severity, CVSS 4.3. EPSS: 4.6% chance of exploitation in the next 30 days. CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and…
CVE-2012-5055, published 2012-12-05. Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days. DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the…
CVE-2010-3700, published 2010-10-29. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote…
CVE-2011-2731, published 2012-12-05. Medium severity, CVSS 5.1. EPSS: 1.3% chance of exploitation in the next 30 days. Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows…