Spring Security URI Path Parameter Security Bypass Vulnerability

Bugtraq ID:	44496
Class:	Design Error
CVE:	CVE-2010-3700
Remote:	Yes
Local:	No
Published:	Oct 27 2010 12:00AM
Updated:	Oct 27 2010 12:00AM
Credit:	Ed Schaller
Vulnerable:	IBM Websphere Application Server 7.0 IBM Websphere Application Server 6.1
Not Vulnerable:

Spring Security URI Path Parameter Security Bypass Vulnerability

Spring Security is prone to a security-bypass vulnerability.

Successfully exploiting this issue allows a remote attacker to bypass certain security restrictions and perform unauthorized actions.

The following applications are affected:

Spring Security: 3.0.0 to 3.0.3 and 2.0.0 to 2.0.5
Acegi Security: 1.0.0 to 1.0.7
IBM WebSphere Application Server 6.1 and 7.0

Spring Security URI Path Parameter Security Bypass Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Spring Security URI Path Parameter Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.

Spring Security URI Path Parameter Security Bypass Vulnerability

References:

• SpringSource Homepage (SpringSource)
  
• CVE-2010-3700: Spring Security bypass of security constraints (s2-security)
  
• 27 October 2010: CVE-2010-3700: Spring Security - Bypass of security constraints (SpringSource)