CVE-2010-3700: VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0,…

Description

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

Exploitation

Is it being used?

Exploit prediction (EPSS)1.7% · higher than 77% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AC

Acegi-security · Acegisecurity

1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +2 more · source: NVD

SS

Springsource Spring Security · Vmware

2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +4 more · source: NVD

WA

Websphere Application Server · Ibm

6.1; 7.0 · source: NVD