There is a vulnerability in Spring Framework that could allow a remote authenticated attacker to bypass security restrictions. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. [CVE-2023-20860]
CVEID:CVE-2023-20860
**DESCRIPTION:**VMware Tanzu Spring Framework could allow a remote attacker to bypass security restrictions, caused by the use of an un-prefixed double wildcard pattern with the mvcRequestMatcher in Spring Security configuration. An attacker could exploit this vulnerability to create a mismatch in pattern matching between Spring Security and Spring MVC.
CVSS Base score: 9.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/250679 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Affected Product(s) | Version(s) |
---|---|
IBM Process Mining |
1.13.2, 1.13.1
Remediation/Fixes guidance:
Product(s) | **Version(s) number and/or range ** | Remediation/Fix/Instructions |
---|---|---|
IBM Process Mining |
1.13.2, 1.13.1
|
Upgrade to version 1.14.0.0
1.Login to PassPortAdvantage
2. Search for
M0BMPML Process Mining 1.14.0.0 Server Multiplatform Multilingual
3. Download package
4. Follow install instructions
5. Repeat for M0BMQML Process Mining 1.14.0.0 Client Windows Multilingual
| |
Workarounds/Mitigation guidance:
None known
CPE | Name | Operator | Version |
---|---|---|---|
ibm cloud pak for automation | eq | 1.12.0.5 |