Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

🗓️ 28 Mar 2023 00:34:28Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 179 Views

Spring Framework security bypass via mvcRequestMatcher pattern mismatch version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.2

Reporter	Title	Published	Views	Family All 93
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager April 2023 - Multiple CVEs	22 May 202309:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities	7 Jun 202314:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	31 May 202317:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	6 Jul 202318:48	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for May 2023	26 Jun 202316:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	7 Jun 202316:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for UNIX is affected by security restriction bypass due to Spring Framework [CVE-2023-20860]	18 May 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Spring Framework affects IBM Tivoli Application Dependency Discovery Manager (CVE-2023-20860, CVE-2023-20861).	10 May 202304:23	–	ibm
IBM Security Bulletins	Security Bulletin: VMware Tanzu Spring Framework is vulnerable to CVE-2023-20860 used in IBM Maximo Application Suite - Monitor Component	24 Jul 202320:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affecting Watson Knowledge Catalog for IBM Cloud Pak for Data	5 Jul 202318:31	–	ibm

Vulners

Node

org.springframework spring-webmvcRange5.3.0–5.3.26maven

org.springframework spring-webmvcRange6.0.0–6.0.7maven

org.springframework springRange5.3.0–5.3.26maven

org.springframework springRange6.0.0–6.0.7maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-20860
spring	www.spring.io/security/cve-2023-20860
github	www.github.com/spring-projects/spring-framework/commit/202fa5cdb3a3d0cfe6967e85fa167d978244f28a
security	www.security.netapp.com/advisory/ntap-20230505-0006
github	www.github.com/advisories/GHSA-7phw-cxx7-q9vq

23 Sep 2025 19:54Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

EPSS0.56284

SSVC