CVE-2010-3700: VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through...

Security readout for executives and security teams

This is a remote security bypass in older Spring Security and Acegi Security deployments. An attacker could manipulate a path parameter so protected web resources are treated as unprotected. The business risk is unauthorized access in legacy Java applications, especially where these libraries are embedded in older IBM WebSphere environments. Exposure is most likely in legacy Java web applications using the named Spring Security or Acegi versions, including IBM WebSphere Application Server 6.1 and 7.0 deployments that include them. Modern applications are unlikely affected unless they retain these old dependencies. Treat this as a legacy-system access-control risk. It deserves priority if affected applications protect sensitive data or are reachable from untrusted networks. The main decision is whether vulnerable legacy frameworks still exist in production and how quickly they can be upgraded or retired. Mitigation focus: Upgrade Spring Security 2.x deployments to 2.0.6 or later.; Upgrade Spring Security 3.x deployments to 3.0.4 or later.; Identify and retire Acegi Security 1.0.0 through 1.0.7 where possible..

Prepared

Jun 28, 2026, 01:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.