critical9.1
CVE-2023-34034
Access Control Bypass in Spring Security
Impact
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.security:spring-security-config | >= 5.6.0, < 5.6.12 | 5.6.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Security | from 5.6.0 before 5.6.12 from 5.7.0 before 5.7.10 from 5.8.0 before 5.8.5 from 6.0.0 before 6.0.5 from 6.1.0 before 6.1.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://security.netapp.com/advisory/ntap-20230814-0008/
- https://spring.io/security/cve-2023-34034
- https://github.com/advisories/GHSA-3h6f-g5f3-gc4w
- https://nvd.nist.gov/vuln/detail/CVE-2023-34034
- https://ossindex.sonatype.org/vulnerability/CVE-2023-34034
- https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-5777893
- https://security.netapp.com/advisory/ntap-20230814-0008