PT-2023-7931 · Spring · Spring Boot

🗓️ 28 Nov 2023 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 2 Views

Spring Boot DoS via crafted requests when using Spring MVC or WebFlux with actuator on classpath.

Reporter	Title	Published	Views	Family All 41
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-boot-2.7.12.jar	7 Jul 202517:50	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Boot, Spring Security and Spring Framework might affect IBM Storage Defender Copy Data Management.	16 May 202519:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.7.2 addresses multiple security vulnerabilities	24 Apr 202415:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in VMware Tanzu Spring Boot	31 Jan 202422:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM B2B Sterling Integrator is vunerable to information disclosure due to Spring Boot	14 Nov 202415:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to VMware Tanzu Spring Boot arbitrary denial of service vulnerability ( CVE-2023-34055)	13 Feb 202414:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for January 2024 - Multiple CVEs addressed	15 Apr 202502:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	27 Mar 202420:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana is affected by Multiple Security Vulnerabilities	16 Feb 202408:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Service is vulnerable to multiple vulnerabilities due to IBM Java	10 May 202404:03	–	ibm

Source	Link
osv	www.osv.dev/vulnerability/CVE-2023-34055
safe-surf	www.safe-surf.ru/specialists/bulletins-nkcki/703844
osv	www.osv.dev/vulnerability/GHSA-jjfh-589g-3hjx
spring	www.spring.io/security/cve-2023-34055
bdu	www.bdu.fstec.ru/vul/2023-09011
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-34055
github	www.github.com/spring-projects/spring-boot
github	www.github.com/spring-projects/spring-boot/commit/5490e73922b37a7f0bdde43eb318cb1038b45d60
t	www.t.me/cvenotify/62174
t	www.t.me/cvenotify/61318

21 Dec 2023 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 26.8

CVSS 3.15.3 - 6.5

EPSS0.00282