CVE-2011-2731
vmware springsource spring security: no CVSS score yet. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in org.springframework.security:spring-security-core 2.0.7, 3.0.6.
Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-362
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vmware:springsource_spring_security
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4644-hg35-55m9 | Maven | org.springframework.security:spring-security-core | <2.0.7 | 2.0.7 |
| GHSA-4644-hg35-55m9 | Maven | org.springframework.security:spring-security-core | >=3.0.0 <3.0.6 | 3.0.6 |