Read the docs
TI-2011-02390 Aliases CVE-2011-2730GHSA-wv88-pf73-x22p

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before…

Priority MEDIUM 46CWE-16Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Partial Red Hat: 9 fixed, 3 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

Why it matters now

EPSS 0.11779 96th percentileScored 2026-11-07
Fix Partial org.springframework:spring-core (Maven): 3.0.6, 2.5.6.SEC03, 2.5.7.SR023Red Hat: 11 advisoriesRed Hat: 9 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.springframework:spring-core (Maven)3.0.0 to before 3.0.63.0.6Patch availableGHSA-wv88-pf73-x22p
—org.springframework:spring-core (Maven)before 2.5.6.SEC032.5.6.SEC03Patch availableGHSA-wv88-pf73-x22p
—org.springframework:spring-core (Maven)2.5.7.SR0 to before 2.5.7.SR0232.5.7.SR023Patch availableGHSA-wv88-pf73-x22p
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.springframework:spring-core (Maven) Vendor— Affected 3.0.0 to before 3.0.6 Fixed in 3.0.6 Patch available GHSA-wv88-pf73-x22p
  • org.springframework:spring-core (Maven) Vendor— Affected before 2.5.6.SEC03 Fixed in 2.5.6.SEC03 Patch available GHSA-wv88-pf73-x22p
  • org.springframework:spring-core (Maven) Vendor— Affected 2.5.7.SR0 to before 2.5.7.SR023 Fixed in 2.5.7.SR023 Patch available GHSA-wv88-pf73-x22p

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:springsource:spring_framework:*:*:*:*:*:*:*:*up to 2.5.7_sr01; up to 3.0.5VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:2.5.0:rc1:*:*:*:*:*:*2.5.0 rc1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:2.5.0:rc2:*:*:*:*:*:*2.5.0 rc2VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:2.5.1:*:*:*:*:*:*:*2.5.1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:2.5.2:*:*:*:*:*:*:*2.5.2VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:2.5.3:*:*:*:*:*:*:*2.5.3VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:2.5.4:*:*:*:*:*:*:*2.5.4VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:2.5.5:*:*:*:*:*:*:*2.5.5VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:2.5.6:*:*:*:*:*:*:*2.5.6VulnerableSpringsource
  • cpe:2.3:a:springsource:spring_framework:*:*:*:*:*:*:*:* Versions up to 2.5.7_sr01; up to 3.0.5 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:2.5.0:rc1:*:*:*:*:*:* Versions 2.5.0 rc1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:2.5.0:rc2:*:*:*:*:*:* Versions 2.5.0 rc2 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:2.5.3:*:*:*:*:*:*:* Versions 2.5.3 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:2.5.4:*:*:*:*:*:*:* Versions 2.5.4 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:2.5.5:*:*:*:*:*:*:* Versions 2.5.5 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:2.5.6:*:*:*:*:*:*:* Versions 2.5.6 Vulnerable ·Springsource
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:springsource:spring_framework:2.5.7:*:*:*:*:*:*:*2.5.7VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableSpringsource
cpe:2.3:a:springsource:spring_framework:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableSpringsource
  • cpe:2.3:a:springsource:spring_framework:2.5.7:*:*:*:*:*:*:* Versions 2.5.7 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Springsource
  • cpe:2.3:a:springsource:spring_framework:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Springsource

Remediation

  • Fix · GHSA-wv88-pf73-x22p org.springframework:spring-core (Maven) Fixed in 3.0.6 Advisory →
  • Fix · GHSA-wv88-pf73-x22p org.springframework:spring-core (Maven) Fixed in 2.5.6.SEC03 Advisory →
  • Fix · GHSA-wv88-pf73-x22p org.springframework:spring-core (Maven) Fixed in 2.5.7.SR023 Advisory →

Red Hat 11 advisories

  • RHSA-2013:0953 Released 2013-06-18 · Red Hat rating Important
    Red Hat JBoss Portal 5.2.2 security update
    • Red Hat JBoss Portal 5.2
  • RHSA-2013:0533 Released 2013-02-20 · Red Hat rating Important
    JBoss Enterprise SOA Platform 5.3.1 update
    • Red Hat JBoss SOA Platform 5.3
  • RHSA-2013:0221 Released 2013-01-31 · Red Hat rating Important
    JBoss Enterprise BRMS Platform 5.3.1 update
    • JBoss Enterprise BRMS Platform 5.3
Show 8 more Red Hat advisories
  • RHSA-2013:0198 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 update
    • Red Hat JBoss Web Platform 5.2
  • RHSA-2013:0197 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 update
    • Red Hat JBoss Web Platform 5 for RHEL 4 AS aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
    • Red Hat JBoss Web Platform 5 for RHEL 4 ES aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
  • RHSA-2013:0196 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 update
    • Red Hat JBoss Web Platform 5 for RHEL 5 Server aopalliance-1.0-5.2.jdk6.ep5.el5, apache-cxf-2.2.12-6.1.patch_04.ep5.el5, bsh2-2.0-0.b4.15.1.patch01.ep5.el5 +47
  • RHSA-2013:0195 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 update
    • Red Hat JBoss Web Platform 5 for RHEL 6 Server aopalliance-1.0-5.3.ep5.el6, apache-cxf-2.2.12-6.1.patch_04.ep5.el6, bsh2-2.0-0.b4.15.patch01.ep5.el6 +47
  • RHSA-2013:0193 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES aopalliance-1.0-5.2.jdk6.ep5.el4, apache-cxf-2.2.12-6.1.patch_04.ep5.el4, bsh2-2.0-0.b4.15.1.patch01.ep5.el4 +47
  • RHSA-2013:0191 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server aopalliance-1.0-5.3.ep5.el6, apache-cxf-2.2.12-6.1.patch_04.ep5.el6, bsh2-2.0-0.b4.15.patch01.ep5.el6 +47
  • RHSA-2013:0192 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server aopalliance-1.0-5.2.jdk6.ep5.el5, apache-cxf-2.2.12-6.1.patch_04.ep5.el5, bsh2-2.0-0.b4.15.1.patch01.ep5.el5 +47
  • RHSA-2013:0194 Released 2013-01-24 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 update
    • Red Hat JBoss Enterprise Application Platform 5.2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss BRMS 5AffectedNo fix yet
Red Hat JBoss Portal 5AffectedNo fix yet
Red Hat JBoss SOA Platform 5AffectedNo fix yet
JBoss Enterprise BRMS Platform 5.3Fixed RHSA-2013:0221
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2013:0192
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 ServerFixed RHSA-2013:0191
Red Hat JBoss Enterprise Application Platform 5.2Fixed RHSA-2013:0194
Red Hat JBoss Portal 5.2Fixed RHSA-2013:0953
Red Hat JBoss SOA Platform 5.3Fixed RHSA-2013:0533
Red Hat JBoss Web Platform 5 for RHEL 5 ServerFixed RHSA-2013:0196
Red Hat JBoss Web Platform 5 for RHEL 6 ServerFixed RHSA-2013:0195
Red Hat JBoss Web Platform 5.2Fixed RHSA-2013:0198

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-2730
  2. 2026-10-03 Alias added: GHSA-wv88-pf73-x22p

References

Advisory 13

Other 7

  • TI-2014-00050 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8… CVSS 2.0MEDIUM 6.8
  • TI-2010-01566 SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and… CVSS 2.0MEDIUM 6.0
  • TI-2013-03625 The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB… CVSS 2.0MEDIUM 6.8
  • TI-2013-05980 The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not… CVSS 2.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences