CVE-2010-3700
Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
Exploit likelihood
What each source reports
NVD Score used
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
- Record
CVE-2010-3700- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
- Record
CVE-2010-3700- Updated
- 2026-11-02
EUVDEUVD-2022-2081 No score
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
- Record
EUVD-2022-2081- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3295-h9qx-r82x No score
Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
- Record
GHSA-3295-h9qx-r82x- Weakness
- CWE-288
- Updated
- 2026-11-02
OSVGHSA-3295-h9qx-r82x No score
Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
- Record
GHSA-3295-h9qx-r82x- Weakness
- CWE-288
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-coreMaven |
2.0.0 up to 2.0.6 | 2.0.6 |
org.springframework.security:spring-security-coreMaven |
3.0.0 up to 3.0.4 | 3.0.4 |
org.acegisecurity:acegi-securityMaven |
1.0.0 to 1.0.7 | None known |
org.springframework.security:spring-security-coreMaven |
2.0.0 up to 2.0.6, plus listed versions 2.0.12.0.22.0.32.0.42.0.5.RELEASE |
2.0.6 |
org.springframework.security:spring-security-coreMaven |
3.0.0 up to 3.0.4, plus listed versions 3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE |
3.0.4 |
org.acegisecurity:acegi-securityMaven |
1.0.0 to 1.0.7, plus listed versions 1.0.11.0.21.0.31.0.41.0.51.0.6 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3700 is a medium vulnerability (CVSS 5.0) in Ibm Websphere Application Server, published October 29, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. Fixed in org.springframework.security:spring-security-core 2.0.6.
References
securityfocus.com/bid/44496
secunia.com/advisories/42024
issues.apache.org/bugzilla/show_bug.cgi?id=25015
springsource.com/security/cve-2010-3700
osvdb.org/68931
nvd.nist.gov/vuln/detail/CVE-2010-3700
web.archive.org/web/20110802082343/http://www.springsource.com/security/cve-2010-3700
github.com/advisories/GHSA-3295-h9qx-r82x