CVE-2011-2894

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/75263Broken Link
http://securityreason.com/securityalert/8405Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-1334.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/519593/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/49536Third Party Advisory, VDB Entry
http://www.springsource.com/security/cve-2011-2894Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/69687Third Party Advisory, VDB Entry
https://web.archive.org/web/20120307233721/http://www.springsource.com/security/cve-2011-2894
http://osvdb.org/75263Broken Link
http://securityreason.com/securityalert/8405Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-1334.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/519593/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/49536Third Party Advisory, VDB Entry
http://www.springsource.com/security/cve-2011-2894Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/69687Third Party Advisory, VDB Entry
https://web.archive.org/web/20120307233721/http://www.springsource.com/security/cve-2011-2894

Timeline

Published: Oct 4, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-28959.3The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress CVE-2011-28965.1The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw funct CVE-2011-28979.8gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flaw CVE-2011-28985.5net/packet/af_packet.c in the Linux kernel before 2.6.39.3 does not properly restrict user-space access to certain packet data structures as CVE-2011-28995.1pysmb.py in system-config-printer 0.6.x and 0.7.x, as used in foomatic-gui and possibly other products, allows remote SMB servers to execute CVE-2011-29007.5Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded CVE-2011-29015.5Off-by-one error in the __addr_ok macro in Xen 3.3 and earlier allows local 64 bit PV guest administrators to cause a denial of service (hos CVE-2011-29025.3zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insec CVE-2011-29036.8Heap-based buffer overflow in tcptrack before 1.4.2 might allow attackers to execute arbitrary code via a long command line argument. NOTE: CVE-2011-29044.3Cross-site scripting (XSS) vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML CVE-2011-29056.2Untrusted search path vulnerability in the perf_config function in tools/perf/util/config.c in perf, as distributed in the Linux kernel befo CVE-2011-29065.5Integer signedness error in the pmcraid_ioctl_passthrough function in drivers/scsi/pmcraid.c in the Linux kernel before 3.1 might allow loca