CVE:CVE-2010-3700
CNNVD:CNNVD-201010-428
运行于IBM WebSphere Application Server (WAS) 6.1和7.0版本下的VMware SpringSource Spring Security 2.0.6之前的2.x版本，3.0.4之前的3.x版本,以及Acegi Security 1.0.0至1.0.7版本中存在权限许可和访问控制漏洞。远程攻击者可以借助path参数绕过安全限制。
solution:Upgrade acegisecurity acegi-security to a higher version than 1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,and avoid the version 1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7; Upgrade vmware springsource_spring_security to a higher version than 2.0.0,2.0.1,2.0.2,2.0.3,2.0.4,2.0.5,3.0.0,3.0.1,3.0.2,3.0.3,and avoid the version 2.0.0,2.0.1,2.0.2,2.0.3,2.0.4,2.0.5,3.0.0,3.0.1,3.0.2,3.0.3; Upgrade ibm websphere_application_server to a higher version than 6.1,7.0,and avoid the version 6.1,7.0