VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 18 hours ago

CVE-2011-2894

6.8 Medium Mitigation candidate

Description

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.

CWE-502 · Deserialization of untrusted data

Exploitation Status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue carries this CVE. Demonstrating a defect and weaponising it are different amounts of work.

CVSS E:P

  • CISA KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in GitHub PoC; first seen 2013-07-31.
  • EPSS 8.6% chance in 30 days
IndexArtifactStarsFirst seen
GitHub PoC Exploit PoC for Spring RCE issue (CVE-2011-2894) 44 2013-07-31

Waratek Defense Posture

Mitigation candidate

A defect of the type ARMR addresses, with a fix path to work from and a working exploit already published. This is a claim on attention, not a scheduling commitment: no rule exists and none is scheduled.

  • Protection none
  • Action unverified patch rule
  • Review human manual-review
  • Record active
Decided by manual classification : Manual classification of this CVE in the legacy dataset
Finding Manual classification assigned status: MITIGATION-CANDIDATE

CVSS

6.8 v2.0 AV:N/AC:M/Au:N/C:P/I:P/A:P 1 metric

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 2.0 6.8 no band published AV:N/AC:M/Au:N/C:P/I:P/A:P NVD Primary published

Affected Software & Releases

☕ Maven Library Packages

Artifact coordinates and fix boundaries from OSV.dev
Package CoordinateIntroducedFixedLast affected
org.springframework:spring-core 3.0.0 3.0.6 unbounded
org.springframework.security:spring-security-core 3.0.0 3.0.6 unbounded
org.springframework.security:spring-security-core 2.0.0 2.0.7 unbounded

🖥️ Product CPEs & Version Ranges

4 product(s) over 5 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
osv org.springframework spring-core generic ≥ 3.0.0 and ＜ 3.0.6
osv org.springframework.security spring-security-core generic ≥ 2.0.0 and ＜ 2.0.7 · ≥ 3.0.0 and ＜ 3.0.6
nvd vmware spring framework generic ≥ 3.0.0 and ≤ 3.0.5
nvd vmware spring security generic ≥ 2.0.0 and ≤ 2.0.6

References

URLTags
https://github.com/spring-projects/spring-framework/commit/070a723ef2c886770a063eb9a67f84f74e06edfb WEB
https://exchange.xforce.ibmcloud.com/vulnerabilities/69687 WEB
https://github.com/spring-projects/spring-framework PACKAGE
https://web.archive.org/web/20120307233721/http://www.springsource.com/security/cve-2011-2894 WEB
http://osvdb.org/75263 WEB
http://securityreason.com/securityalert/8405 WEB
http://www.redhat.com/support/errata/RHSA-2011-1334.html WEB
http://www.securityfocus.com/archive/1/519593/100/0/threaded WEB
http://www.securityfocus.com/bid/49536 WEB
http://www.springsource.com/security/cve-2011-2894 WEB

Timeline

Published 2011-10-04 Last modified 2026-06-16
Published2011-10-04By the CVE Program.
NVD record modified2026-06-16NVD's own last-modified date for this record.