CVE-2011-2730 - CVE House
Back to Database
Status published High CVE-2011-2730

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before...

Vulnerability Description

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2011-2730

Credits & Attribution

No credits recorded in the NVD database.

References

More from springsource

View All →
CVE-2014-0054
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8...
Medium 6.8
CVE-2013-7315
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1...
Medium 6.8
CVE-2013-4152
The Spring OXM wrapper in Spring Framework before 3.2.4 and...
Medium 6.8
CVE-2012-1833
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does...
Medium 5
CVE-2009-2907
Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B...
Medium 4.3

Affected Vendor

springsource

View all reports →

Affected Software

spring framework
Vulnerable Versions:
0, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4

Timeline

Official Publish: December 5th, 2012
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.