by Kastro
Paper/Archive/CVE-2023-34034

CVE-2023-34034

vmware — Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and…

EPSS 4%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 90.7.907 × 2018.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

Affected

ProductAffectedFixed inSource
Spring SecuritySpring Security 6.1.0 – 6.1.1–CNA
Spring SecuritySpring Security 6.0.0 – 6.0.4–CNA
Spring SecuritySpring Security 5.8.0 – 5.8.4–CNA
Spring SecuritySpring Security 5.7.0 – 5.7.9 –CNA
Spring SecuritySpring Security 5.6.0 – 5.6.11–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vmware (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refspring.io/security/cve-2023-34034refsecurity.netapp.com/advisory/ntap-20230814-0008