CVE-2023-34035

2023-07-1816:15:11

CWE-863

vmware

web.nvd.nist.gov

cve-2023-34035

spring security

authorization

misconfiguration

vulnerability

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

29.7%

JSON

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. (DispatcherServlet is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)

Specifically, an application is vulnerable when all of the following are true:

Spring MVC is on the classpath
Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet)
The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpoints

An application is not vulnerable if any of the following is true:

The application does not have Spring MVC on the classpath
The application secures no servlets other than Spring MVC’s DispatcherServlet
The application uses requestMatchers(String) only for Spring MVC endpoints

Affected configurations

Nvd

Node

vmwarespring_securityRange5.8.0–5.8.5

vmwarespring_securityRange6.0.0–6.0.5

vmwarespring_securityRange6.1.0–6.1.2

VendorProductVersionCPE
vmwarespring_security*cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vmware	spring_security	*	cpe:2.3:a:vmware:spring_security::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Spring Security",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Spring Security 5.8.0 to 5.8.4, Spring Security 6.0.0 to 6.0.4, Spring Security 6.1.0 to 6.1.1"
      }
    ]
  }
]