CVE-2011-2732

CVE-2011-2732 describes a CRLF injection vulnerability within the logout functionality of VMware SpringSource Spring Security versions prior to 2.0.7 and 3.0.x prior to 3.0.6. This flaw allows remote, unauthenticated attackers to inject arbitrary HTTP headers and perform HTTP response splitting attacks by manipulating the spring-security-redirect parameter. The vulnerability has a CVSS score of 4.3, indicating a medium severity due to its network-based attack vector and medium attack complexity, with a potential impact of partial integrity compromise. While not listed in CISA's KEV catalog, an exploit for HTTP header injection exists on ExploitDB, though there is no evidence of active exploitation or significant community discussion.