Skip to content
OpenAdvisories
Medium CVE-2011-2731 EUVD-2022-2313GHSA-4644-hg35-55m9

Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

Published Dec 5, 2012 · Updated Aug 6, 2024 · Assigned by redhat

Package: org.springframework.security:spring-security-core Ecosystem: Maven

Description

Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.springframework.security:spring-security-core < 2.0.7 2.0.7 GHSA-4644-hg35-55m9
Maven org.springframework.security:spring-security-core >= 3.0.0, < 3.0.6 3.0.6 GHSA-4644-hg35-55m9

References