CVE-2023-20863

2023-04-1300:00:00

CWE-400

vmware

www.cve.org

cve-2023-20863

spring framework

dos vulnerability

6.7 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.0%

JSON

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Spring Framework",
    "versions": [
      {
        "version": "Spring framework versions 5.2.x.release prior to 5.2.24.release+, 5.3.x prior to 5.3.27+, 6.0.x prior to 6.0.8+ and older unsupported versions",
        "status": "affected"
      }
    ]
  }
]