CVE-2011-2894

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.

Published: 2011-10-04 Last update: 2026-04-29 Assigner: [email protected] Source: [email protected]

NVD Status：Modified，CVE State: published

View at NVD, CVE.org, EUVD

Threat Intelligence & Risk Assessment for CVE-2011-2894

EPSS CVSS CWE GHSA Affected OS Tracker

Conclusion & alert: CVE-2011-2894 is rated Moderate Risk (56.4/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 2.00%). Mandatory action: Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2011-2894

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-04-23	2.11%	2.00%	-0.11%
2	2026-04-01	1.72%	2.11%	+0.39%
3	2026-03-17	—	1.72%	—

Full EPSS history (19 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2011-2894

CVSS metrics for this CVE.

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.8	2.0	MEDIUM	`AV:N/AC:M/Au:N/C:P/I:P/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	8.6	6.4	[email protected]

Weakness enumeration for CVE-2011-2894

CWE-502 MITRE ↗

GitHub Security Advisory for CVE-2011-2894

GHSA-f866-m9mv-2xr3 · Severity: medium · Ecosystem: maven — Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data

OS Trackers for CVE-2011-2894

vendor	priority	summary	link
`redhat`	high	—	https://access.redhat.com/security/cve/CVE-2011-2894
`ubuntu`	medium	CVE-2011-2894 medium priority: Ubuntu including 3 source packages (libspring-2.5-java, libspring-java, libspring-security-2.0-java), 63 status rows across 21 suites (artful, bionic, cosmic, disco, hardy, lucid, maverick, natty, oneiric, precise, quantal, raring, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): DNE 30, ignored 25, not-affected 5, needs-triage 3.	https://ubuntu.com/security/CVE-2011-2894

Affected software / configurations for CVE-2011-2894

Vendor	Product	Version	Raw CPE
vmware	spring_framework	>= 3.0.0, <= 3.0.5	cpe:2.3:a:vmware:spring_framework::::::::
vmware	spring_security	>= 2.0.0, <= 2.0.6	cpe:2.3:a:vmware:spring_security::::::::

References for CVE-2011-2894

URL	Tags
http://osvdb.org/75263	Broken Link
http://securityreason.com/securityalert/8405	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-1334.html	Third Party Advisory
http://www.securityfocus.com/archive/1/519593/100/0/threaded	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/49536	Third Party Advisory VDB Entry
http://www.springsource.com/security/cve-2011-2894	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/69687	Third Party Advisory VDB Entry
https://web.archive.org/web/20120307233721/http://www.springsource.com/security/cve-2011-2894

cvelogic Threat Intelligence