9.1
Critical
CVE-2023-34034 Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between…
Description
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Security 6.1 | earliest → 6.1.1 | No fix stated |
| Spring Security 6.0 | earliest → 6.0.4 | No fix stated |
| Spring Security 5.8 | earliest → 5.8.4 | No fix stated |
| Spring Security 5.7 | earliest → 5.7.9 | No fix stated |
| Spring Security 5.6 | earliest → 5.6.11 | No fix stated |
References
- spring.io spring.io
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of Spring Security
The 10 CVEs of Spring Security →
CVE-2024-22257
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions…
8.2
High
CVE-2023-34042
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were …
4.1
Medium
CVE-2023-34035
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to…
7.3
High
CVE-2023-20862
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the…
6.3
Medium