Every CVESearch/Get API key

CVE-2010-3700

Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

5.0 MediumFix available

CVE-2010-3700 is a medium vulnerability (CVSS 5.0) in Ibm Websphere Application Server, published October 29, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. Fixed in org.springframework.security:spring-security-core 2.0.6.

What does this mean?
Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
1.69%EPSS, 77th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.0.6org.springframework.security:spring-security-core +5 more

Description

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

Exploit likelihood

1.69%Up 0.4 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.springframework.security:spring-security-core
Maven
2.0.0 up to 2.0.6
2.0.6
org.springframework.security:spring-security-core
Maven
3.0.0 up to 3.0.4
3.0.4
org.acegisecurity:acegi-security
Maven
1.0.0 to 1.0.7None known
org.springframework.security:spring-security-core
Maven
2.0.0 up to 2.0.6, plus listed versions
2.0.12.0.22.0.32.0.42.0.5.RELEASE
2.0.6
org.springframework.security:spring-security-core
Maven
3.0.0 up to 3.0.4, plus listed versions
3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE
3.0.4
org.acegisecurity:acegi-security
Maven
1.0.0 to 1.0.7, plus listed versions
1.0.11.0.21.0.31.0.41.0.51.0.6
None known

What each source reports

NVD Score used5.0

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

Record
CVE-2010-3700
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE ListNo score

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

Record
CVE-2010-3700
Updated
2026-11-02
EUVDEUVD-2022-2081No score

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

Record
EUVD-2022-2081
Updated
2026-11-03
GitHub AdvisoriesGHSA-3295-h9qx-r82xNo score

Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

Record
GHSA-3295-h9qx-r82x
Weakness
CWE-288
Updated
2026-11-02
OSVGHSA-3295-h9qx-r82xNo score

Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

Record
GHSA-3295-h9qx-r82x
Weakness
CWE-288
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open