Lucene search
GitHub Advisory DatabaseGHSA-7PHW-CXX7-Q9VQHistoryMar 28, 2023 - 12:34 a.m.
Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch
2023-03-2800:34:28
GitHub Advisory Database
github.com
152
0.001 Low
EPSS
Percentile
36.1%
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using “**” as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.springframework:spring | lt | 5.3.26 | |
| org.springframework:spring | lt | 6.0.7 |
Related
ibm
ibm
Security Bulletin: IBM Sterling Connect:Direct for UNIX is affected by security restriction bypass due to Spring Framework [CVE-2023-20860]
2023-05-18 17:28:21
veracode
veracode
Security Bypass
2023-03-30 02:11:25
ubuntucve
ubuntucve
CVE-2023-20860
2023-03-27 00:00:00
debiancve
debiancve
CVE-2023-20860
2023-03-27 22:15:21
osv
osv
CVE-2023-20860
2023-03-27 22:15:21
prion
prion
Security feature bypass
2023-03-27 22:15:00
githubexploit
githubexploit
Exploit for Vulnerability in Vmware Spring Framework
2023-03-24 07:23:52
cvelist
cvelist
CVE-2023-20860
2023-03-27 00:00:00
nessus
nessus
RHEL 8 : Red Hat Virtualization (RHSA-2023:3771)
2023-06-22 00:00:00
Oracle Identity Manager (Jul 2023 CPU)
2023-07-21 00:00:00
f5
f5
K000134500 : Spring Framework vulnerability CVE-2023-20860
2023-05-08 00:00:00
cve
cve
CVE-2023-20860
2023-03-27 22:15:21
atlassian
atlassian
Upgrade spring-core for CVE-2023-20860
2023-05-17 06:46:56
openvas
openvas
spring
spring
This Week in Spring - March 21st, 2023
2023-03-21 00:00:00
redhatcve
redhatcve
CVE-2023-20861
2023-03-24 13:07:29
CVE-2023-20860
2023-03-24 13:07:33
redhat
redhat
oracle
oracle
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00