NVD

Id
9462  
Name
CVE-2011-2730  
Description
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2012-12-05  
Modified Date
2015-01-17  
Seq
2011-2730  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
54119 9462 CVE-2011-2730 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814  View
54120 9462 CVE-2011-2730 RHSA-2013:0191  View
54121 9462 CVE-2011-2730 RHSA-2013:0192  View
54122 9462 CVE-2011-2730 RHSA-2013:0193  View
54123 9462 CVE-2011-2730 RHSA-2013:0194  View
54124 9462 CVE-2011-2730 RHSA-2013:0195  View
54125 9462 CVE-2011-2730 RHSA-2013:0196  View
54126 9462 CVE-2011-2730 RHSA-2013:0197  View
54127 9462 CVE-2011-2730 RHSA-2013:0198  View
54128 9462 CVE-2011-2730 RHSA-2013:0221  View
54129 9462 CVE-2011-2730 RHSA-2013:0533  View
54130 9462 CVE-2011-2730 http://support.springsource.com/security/cve-2011-2730  View
54131 9462 CVE-2011-2730 DSA-2504  View
54132 9462 CVE-2011-2730 1029151  View
54133 9462 CVE-2011-2730 https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
34963 JVNDB-2011-005205 VMware SpringSource Spring Framework における重要な情報を取得される脆弱性 VMware SpringSource Spring Framework は、式言語 (Expression Language、EL) をコンテナがサポートしている場合、タグ内の EL 式を 2 回値を求めるため、重要な情報を取得される脆弱性が存在します。 CVE-2011-2730 50637 CVE-2011-2730 9462 7.5 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-005205.html 2011-09-09 2013-01-23 View