CVE-2010-3700

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-10-29 · updated 2026-06-16
Weakness: CWE-264

Description

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

Affected products

Acegisecurity Acegi-Security: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+2)
IBM WebSphere Application Server: 6.1, 7.0
VMware Springsource Spring Security: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5 (+4)

References

http://osvdb.org/68931
http://secunia.com/advisories/42024
http://www.securityfocus.com/archive/1/514517/100/0/threaded
http://www.securityfocus.com/bid/44496
http://www.springsource.com/security/cve-2010-3700
https://issues.apache.org/bugzilla/show_bug.cgi?id=25015
http://osvdb.org/68931
http://secunia.com/advisories/42024
http://www.securityfocus.com/archive/1/514517/100/0/threaded
http://www.securityfocus.com/bid/44496
http://www.springsource.com/security/cve-2010-3700
https://issues.apache.org/bugzilla/show_bug.cgi?id=25015

Get alerted when CVE-2010-3700 or the next vulnerability affects your stack