Security Bulletin: VMware Tanzu Spring Security is vulnerable to CVE-2023-34034 and CVE-2023-34035 used in IBM Maximo Application Suite - Monitor Component

2023-09-2618:30:31

www.ibm.com

vmware

tanzu spring security

ibm maximo

monitor component

cve-2023-34034

cve-2023-34035

webflux

servlets

authorization rule misconfiguration

fixpack

update available

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

69.5%

JSON

Summary

IBM Maximo Application Suite - Monitor Component uses VMware Tanzu Spring Security which is vulnerable to CVE-2023-34034 and CVE-2023-34035. The vulnerabilities in the product component have been addressed.

Vulnerability Details

CVEID:CVE-2023-34034
**DESCRIPTION:VMware Tanzu Spring Security could allow a remote attacker to bypass security restrictions, caused by a flaw when using "" as a pattern in the configuration for WebFlux. By using a specially crafted configuration, an attacker could exploit this vulnerability to bypass pattern matching rules.
CVSS Base score: 9.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/261126 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:CVE-2023-34035
**DESCRIPTION:**VMware Tanzu Spring Security could allow a remote attacker to bypass security restrictions, caused by a flaw when the application uses requestMatchers(String) and multiple servlets. By using a specially crafted configuration, an attacker could exploit this vulnerability to cause an authorization rule misconfiguration issue.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/261127 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)