CVE-2010-3700
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- acegisecurity:acegi-security
- ibm:websphere_application_server
- vmware:springsource_spring_security
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3295-h9qx-r82x | Maven | org.springframework.security:spring-security-core | >=2.0.0 <2.0.6 | 2.0.6 |
| GHSA-3295-h9qx-r82x | Maven | org.springframework.security:spring-security-core | >=3.0.0 <3.0.4 | 3.0.4 |
| GHSA-3295-h9qx-r82x | Maven | org.acegisecurity:acegi-security | >=1.0.0 <=1.0.7 | no fix published |