Description
Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
Remediation
References
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814
http://secunia.com/advisories/55155
http://support.springsource.com/security/cve-2011-2731
http://www.securitytracker.com/id/1029151
Related Vulnerabilities
CVE-2022-22979 Vulnerability in maven package org.springframework.cloud:spring-cloud-function-parent
CVE-2022-34790 Vulnerability in maven package org.jenkins-ci.plugins:xfpanel
CVE-2023-30429 Vulnerability in maven package org.apache.pulsar:pulsar-broker-common
CVE-2017-15682 Vulnerability in maven package org.craftercms:crafter-studio
CVE-2019-10405 Vulnerability in maven package org.jenkins-ci.main:jenkins-core