CVE-2023-34040 Java Deserialization vulnerability in Spring-Kafka When Improperly Configured

🗓️ 24 Aug 2023 12:59:20Reported by vmwareType

CVE-2023-34040 Spring-Kafka Deserialization Vulnerability

Reporter	Title	Published	Views	Family All 21
GithubExploit	Exploit for Deserialization of Untrusted Data in Vmware Spring_For_Apache_Kafka	28 Sep 202311:18	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Vmware Spring_For_Apache_Kafka	24 Apr 202403:54	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	30 Jan 202404:12	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.11 addresses multiple security vulnerabilities.	20 Dec 202316:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	17 Oct 202400:20	–	ibm
IBM Security Bulletins	Security Bulletin: VMware Tanzu Spring for Apache Kafka is vulnerable to CVE-2023-34040 used in IBM Maximo Application Suite - Monitor Component	26 Sep 202318:33	–	ibm
BDU FSTEC	The vulnerability of the Spring-based Apache Kafka software platform (spring-kafka) is related to deficiencies in the deserialization mechanism. This allows attackers to execute arbitrary code or trigger service failures.	7 Sep 202300:00	–	bdu_fstec
Circl	CVE-2023-34040	24 Aug 202316:14	–	circl
CNNVD	Spring Framework 代码问题漏洞	24 Aug 202300:00	–	cnnvd
CVE	CVE-2023-34040	24 Aug 202312:59	–	cve

[
  {
    "defaultStatus": "unaffected",
    "product": "Spring For Apache Kafka",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "2.9.11",
        "status": "affected",
        "version": "2.8.x",
        "versionType": "2.9.11"
      },
      {
        "lessThan": "2.9.11",
        "status": "affected",
        "version": "2.9.x",
        "versionType": "2.9.11"
      },
      {
        "lessThan": "3.0.10",
        "status": "affected",
        "version": "3.0.x",
        "versionType": "3.0.10"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2023-34040

24 Aug 2023 12:59Current

7.6High risk

Vulners AI Score7.6

CVSS 3.15.3

EPSS0.21413

CWE-502