CVE-2023-34040

🗓️ 24 Aug 2023 12:59:20Reported by vmwareType

Spring for Apache Kafka 3.0.9 and earlier version vulnerability due to malicious serialized object deserialization

Reporter	Title	Published	Views	Family All 20
GithubExploit	Exploit for Deserialization of Untrusted Data in Vmware Spring_For_Apache_Kafka	28 Sep 202311:18	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Vmware Spring_For_Apache_Kafka	24 Apr 202403:54	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	30 Jan 202404:12	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.11 addresses multiple security vulnerabilities.	20 Dec 202316:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	17 Oct 202400:20	–	ibm
IBM Security Bulletins	Security Bulletin: VMware Tanzu Spring for Apache Kafka is vulnerable to CVE-2023-34040 used in IBM Maximo Application Suite - Monitor Component	26 Sep 202318:33	–	ibm
Circl	CVE-2023-34040	24 Aug 202316:14	–	circl
CNNVD	Spring Framework 代码问题漏洞	24 Aug 202300:00	–	cnnvd
Cvelist	CVE-2023-34040 Java Deserialization vulnerability in Spring-Kafka When Improperly Configured	24 Aug 202312:59	–	cvelist
Github Security Blog	Spring-Kafka has Java Deserialization vulnerability When Improperly Configured	24 Aug 202315:31	–	github

NVD

Node

vmware spring_for_apache_kafkaRange2.8.1–2.9.10

vmware spring_for_apache_kafkaRange3.0.0–3.0.9

[
  {
    "defaultStatus": "unaffected",
    "product": "Spring For Apache Kafka",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "2.9.11",
        "status": "affected",
        "version": "2.8.x",
        "versionType": "2.9.11"
      },
      {
        "lessThan": "2.9.11",
        "status": "affected",
        "version": "2.9.x",
        "versionType": "2.9.11"
      },
      {
        "lessThan": "3.0.10",
        "status": "affected",
        "version": "3.0.x",
        "versionType": "3.0.10"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2023-34040

21 Nov 2024 08:06Current

6Medium risk

Vulners AI Score6

CVSS 3.15.3 - 7.8

EPSS0.21413

SSVC

CWE-502