CVE Feed

    Dashboard / CVE / CVE-2011-2894

    CVE-2011-2894

    Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.

    Published:Sep 9, 2011
    Last Modified:Apr 11, 2025
    EPS:Oct 4, 2011
    EPSS Score:0.15075
    CVSS Score:6.8

    Affected Products

    Vendor
    Redhat
    Product
    Jboss Soa Platform
    Vendor
    Vmware
    Product
    Spring Framework
    Vendor
    Vmware
    Product
    Spring Security

    Exploits

    https://github.com/pwntester/SpringBreaker

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-586 Object Injection

    Related CVEs

    CVE-2020-14340 (CVSS 5.9) — A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector fi…
    CVE-2012-5626 (CVSS 7.5) — EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations …
    CVE-2011-4605 (CVSS 7.5) — The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Applicati…
    CVE-2012-2377 (CVSS 3.3) — JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and B…
    CVE-2012-1167 (CVSS 4.6) — The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platf…
    CVE-2011-4610 (CVSS 5) — JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2…
    CVE-2012-0079 (CVSS 4.3) — Unspecified vulnerability in Oracle OpenSSO 7.1 and 8.0 allows remote attackers to affect integrity via unknow…
    CVE-2012-0022 (CVSS 5) — Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for h…
    CVE-2011-5245 (CVSS 5) — The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers t…
    CVE-2012-0818 (CVSS 5) — RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DO…

    References

    http://osvdb.org/75263
    http://securityreason.com/securityalert/8405
    http://www.redhat.com/support/errata/RHSA-2011-1334.html
    http://www.securityfocus.com/archive/1/519593/100/0/threaded
    http://www.securityfocus.com/bid/49536
    http://www.springsource.com/security/cve-2011-2894
    https://exchange.xforce.ibmcloud.com/vulnerabilities/69687
    https://web.archive.org/web/20120307233721/http://www.springsource.com/security/cve-2011-2894
    http://osvdb.org/75263
    http://securityreason.com/securityalert/8405
    http://www.redhat.com/support/errata/RHSA-2011-1334.html
    http://www.securityfocus.com/archive/1/519593/100/0/threaded
    http://www.securityfocus.com/bid/49536
    http://www.springsource.com/security/cve-2011-2894
    https://exchange.xforce.ibmcloud.com/vulnerabilities/69687
    https://web.archive.org/web/20120307233721/http://www.springsource.com/security/cve-2011-2894

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High