CVE-2011-2730

[CVE catalog]

Severity

Unknown

Published

Sep 9, 2011, 12:00:00 AM UTC

Updated

Mar 9, 2026, 1:17:45 AM UTC

Source

[NVD] · [CVE record]

EPSS

11.78% · Oct 25, 2026

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection." Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure This flaw was originally reported as resulting in information disclosure only, and was therefore assessed as having low security impact. On this basis, it was planned that future updates to JBoss products may address this flaw. New research [0] has now shown that this flaw can lead to remote code execution. The security impact has been re-assessed as important, and Red Hat is now working on patches for all affected products. [0] http://danamodio.com/application-security/discoveries/spring-remote-code-with-expression-language-injection/ The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.