{"action":"Upgrade org.springframework:spring-core to 3.0.6 or later.","affected":[{"fixed":"3.0.6","introduced":"3.0.0"}],"component":"org.springframework:spring-core","cve_ids":["CVE-2011-2894"],"ecosystem":"Maven","epss":0.08601,"exploited":false,"fixed_versions":["3.0.6"],"ghsa_id":"GHSA-f866-m9mv-2xr3","id":"tcs_01M5N8VF5ZC01Q8CH0KABXGT1J","modified_at":"2024-12-03T06:08:45.298122Z","published_at":"2022-05-14T02:54:56Z","references":["https://osv.dev/vulnerability/GHSA-f866-m9mv-2xr3","https://nvd.nist.gov/vuln/detail/CVE-2011-2894","https://github.com/spring-projects/spring-framework/commit/070a723ef2c886770a063eb9a67f84f74e06edfb","https://exchange.xforce.ibmcloud.com/vulnerabilities/69687","https://github.com/spring-projects/spring-framework","https://web.archive.org/web/20120307233721/http://www.springsource.com/security/cve-2011-2894","http://osvdb.org/75263","http://securityreason.com/securityalert/8405","http://www.redhat.com/support/errata/RHSA-2011-1334.html","http://www.securityfocus.com/archive/1/519593/100/0/threaded","http://www.securityfocus.com/bid/49536","http://www.springsource.com/security/cve-2011-2894"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-f866-m9mv-2xr3","url":"https://osv.dev/vulnerability/GHSA-f866-m9mv-2xr3"}],"summary":"Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data"}