CVE-2011-2732

Name of the Vulnerable Software and Affected Versions VMware SpringSource Spring Security versions prior to 2.0.7 VMware SpringSource Spring Security versions 3.0.x prior to 3.0.6

Description The issue concerns a CRLF injection vulnerability in the logout functionality. This allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

Recommendations For versions prior to 2.0.7, update to version 2.0.7 or later. For versions 3.0.x prior to 3.0.6, update to version 3.0.6 or later.