{"id":"CVE-2011-2732","aliases":["EUVD-2022-2679","GHSA-5xm9-rf63-wj7h"],"status":"published","title":"Improper Control of Generation of Code in Spring Security","description":"CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04646,"percentile":0.91788,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2012-12-05T17:00:00Z","modified":"2026-06-16T23:31:53Z","exploits":[{"source":"exploitdb","id":"EDB-36130","title":"Spring Security - HTTP Header Injection","type":"remote","platform":"multiple","date":"2011-09-09","verified":true,"url":"https://www.exploit-db.com/exploits/36130"}],"fixes":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-core","fixed_in":["2.0.7","3.0.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5.RELEASE","2.0.6.RELEASE"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.6"}]}],"versions":["3.0.0.RELEASE","3.0.1.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE"]}],"products":[{"vendor":"vmware","product":"springsource_spring_security"}],"references":[{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://support.springsource.com/security/cve-2011-2732","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2732","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5xm9-rf63-wj7h"},{"url":"https://github.com/spring-projects/spring-security","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2011-2732","description":"CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.","status":"published","published":"2012-12-05T17:00:00Z","modified":"2024-08-06T23:08:23.789Z","updated_at":"2026-11-02T14:35:36.968002Z"}],"euvd":[{"id":"EUVD-2022-2679","description":"CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.","status":"published","published":"2012-12-05T17:00:00Z","modified":"2024-08-06T23:08:23Z","updated_at":"2026-11-03T01:39:54.68331Z"}],"ghsa":[{"id":"GHSA-5xm9-rf63-wj7h","title":"Improper Control of Generation of Code in Spring Security","description":"CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.","status":"published","published":"2022-05-17T05:18:15Z","modified":"2023-01-27T05:02:26Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:36:18.427692Z"}],"nvd":[{"id":"CVE-2011-2732","description":"CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.","status":"published","published":"2012-12-05T17:55:01.537Z","modified":"2026-06-16T23:31:53.547Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:02:12.639283Z"}],"osv":[{"id":"GHSA-5xm9-rf63-wj7h","title":"Improper Control of Generation of Code in Spring Security","description":"CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.","status":"published","published":"2022-05-17T05:18:15Z","modified":"2024-12-07T05:36:23.375662Z","cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}