GHSA-wv88-pf73-x22p CVE-2011-2730

Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework

High Maven

Severity: High; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): 11.78%; Chance of exploitation in the next 30 days. Higher than 96.08% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 3.0.6; Upgrade org.springframework:spring-core to this version or later

Description

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

Affected versions

Maven

Package	Vulnerable	Fixed in
org.springframework:spring-core	`>= 3.0.0, < 3.0.6`	`3.0.6`
org.springframework:spring-core	`< 2.5.6.SEC03`	`2.5.6.SEC03`
org.springframework:spring-core	`>= 2.5.7.SR0, < 2.5.7.SR023`	`2.5.7.SR023`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.springframework:spring-core Maven → `3.0.6`

maven

<dependency><groupId>org.springframework</groupId><artifactId>spring-core</artifactId><version>3.0.6</version></dependency>

gradle

implementation("org.springframework:spring-core:3.0.6")

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2011-2730

Packages

github.com/spring-projects/spring-framework

Timeline

May 17, 2022 Published
Dec 5, 2024 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-659m-px2c-25wj Spring Framework Denial of Service via AntPathMatcher	High	Also affects org.springframework:spring-core
GHSA-jmp9-x22r-554x Spring Framework annotation detection mechanism may result in improper authorization	High	Also affects org.springframework:spring-core
GHSA-r4q3-7g4q-x89m Spring Framework server Web DoS Vulnerability	High	Also affects org.springframework:spring-core
GHSA-rfmp-97jj-h8m6 Improper Output Neutralization for Logs in Spring Framework	Medium	Also affects org.springframework:spring-core
GHSA-f866-m9mv-2xr3 Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data	Medium	Also affects org.springframework:spring-core
GHSA-rhcg-rwhx-qj3j Improper Limitation of a Pathname to a Restricted Directory in Spring Framework	Medium	Also affects org.springframework:spring-core
GHSA-wjjr-h4wh-w6vv Spring Framework Inefficient Regular Expression Complexity	Medium	Also affects org.springframework:spring-core
GHSA-6gf2-pvqw-37ph Log entry injection in Spring Framework	Medium	Also affects org.springframework:spring-core

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor