spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry

🗓️ 13 Sep 2023 15:40:09Reported by RedHatType

Spring Boot actuator flaw enables security bypass on Cloud Foundry via wildcard /cloudfoundryapplication/** requests.

Reporter	Title	Published	Views	Family All 39
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in VMware Tanzu Spring Boot	28 Jun 202321:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restriction bypass in VMware Tanzu Spring Boot (CVE-2023-20873)	12 Jul 202321:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	7 Jun 202316:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.5.0 fixes multiple security vulnerabilities	20 Jun 202308:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in VMware Tanzu Spring Boot	14 Jul 202323:17	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring Framework affects IBM Process Mining . CVE-2023-20873	27 Jun 202311:49	–	ibm
Circl	CVE-2023-20873	21 Apr 202300:30	–	circl
CNNVD	Spring Framework 安全漏洞	20 Apr 202300:00	–	cnnvd
CVE	CVE-2023-20873	20 Apr 202300:00	–	cve
Cvelist	CVE-2023-20873	20 Apr 202300:00	–	cvelist

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2023-20873
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/advisories/GHSA-g5h3-w546-pj7f
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-20873
spring	www.spring.io/security/cve-2023-20873/
cve	www.cve.org/CVERecord

28 Jun 2026 12:40Current

7.3High risk

Vulners AI Score7.3

CVSS 3.19.8

EPSS0.01122

SSVC