SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3
    allows remote attackers to execute arbitrary code via an HTTP request containing
    class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file. (CVE-2010-1622)

The version Oracle WebCenter Sites installed on the remote host is missing security patches from the October 2015 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the bundled SpringSource Spring     Framework that allows a remote attacker to execute     arbitrary code via an HTTP request containing     class.classLoader.URLs[0]=jar: followed by an URL of a     crafted .jar file. (CVE-2010-1622)

  - An unspecified flaw exists in the Security subcomponent     that allows a remote attacker to impact integrity.
    (CVE-2015-4799)

ID	Name	Product	Family	Severity
419474	SCA: security update for org.springframework:spring (GHSA-vpr3-f594-mg5g)	Tenable Cloud Security	SCA Checks	medium
419474	SCA: security update for org.springframework:spring (GHSA-vpr3-f594-mg5g)	Tenable Self-Hosted Container Security	SCA Checks	medium
86577	Oracle WebCenter Sites Multiple Vulnerabilities (October 2015 CPU)	Nessus	Windows	medium

Detections

Analytics

CVE-2010-1622

medium

Tenable Plugins

medium

medium

medium