ca.uhn.hapi.fhir:hapi-fhir-spring-boot-sample-client-apache (>=6.2.0, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-spring-boot-sample-client-okhttp (>=6.2.0, <=6.4.7) +1714 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=2.7.0, <=2.7.10)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =2.7.0, =6.2.0, =6.2.0, =6.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0 - cc.zhaoac:faith-tool-boot 1.1.0 - cc.zhaoac:faith-tool-common 1.1.0 - cc.zhaoac:faith-tool-launch 1.1.0 and more Sourc...

Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users...

ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.2.0), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +5550 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=2.0.0.release, <=2.5.14)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =2.0.0.release, =0.1.2, =0.5.0, =0.5.21, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.24 and more Source cves: CVE-2023-20873 Source advisory: GHSA-G5H3-W546-P...

ai.ylyue:yue-library-auth-client (>=j11.2.6.0, <=j11.2.6.1), ai.ylyue:yue-library-auth-service (>=j11.2.6.0, <=j11.2.6.1) +1579 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=2.6.0, <=2.6.14)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =1.0.6, =1.0.6, =1.0.6, =1.0.7 and more Source cves: CVE-2023-20873 Source advisory:...

ca.uhn.hapi.fhir:hapi-fhir-spring-boot-sample-client-apache (>=6.2.0, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-spring-boot-sample-client-okhttp (>=6.2.0, <=6.4.7) +1714 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=2.7.0, <=2.7.10)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =2.7.0, =6.2.0, =6.2.0, =6.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0 - cc.zhaoac:faith-tool-boot 1.1.0 - cc.zhaoac:faith-tool-common 1.1.0 - cc.zhaoac:faith-tool-launch 1.1.0 and more Sourc...

cc.vihackerframework:vihacker-auth-starter (1.0.8.r), cc.vihackerframework:vihacker-common-starter (1.0.8.r) +769 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=3.0.0, <=3.0.5)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =3.0.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.4.0 and more Source cves: CVE-2023-20873 Source advisory: OSV:GHSA-G5H3-W546-PJ7F...

cc.vihackerframework:vihacker-auth-starter (1.0.8.r), cc.vihackerframework:vihacker-common-starter (1.0.8.r) +769 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=3.0.0, <=3.0.5)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =3.0.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.4.0 and more Source cves: CVE-2023-20873 Source advisory: GHSA-G5H3-W546-PJ7F...

ai.ylyue:yue-library-auth-client (>=j11.2.6.0, <=j11.2.6.1), ai.ylyue:yue-library-auth-service (>=j11.2.6.0, <=j11.2.6.1) +1579 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=2.6.0, <=2.6.14)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =1.0.6, =1.0.6, =1.0.6, =1.0.7 and more Source cves: CVE-2023-20873 Source advisory:...

ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.2.0), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +5550 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=2.0.0.release, <=2.5.14)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =2.0.0.release, =0.1.2, =0.5.0, =0.5.21, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.24 and more Source cves: CVE-2023-20873 Source advisory: OSV:GHSA-G5H3-W5...

CVE-2023-20873

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users...

Security feature bypass

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users...

spring-boot:ConfigurationMetadataRepositoryJsonBuilderFuzzer: Security exception in org.json.JSONArray.writeTo

Detailed Report: https://oss-fuzz.com/testcase?key=5103218685509632 Project: spring-boot Fuzzing Engine: libFuzzer Fuzz Target: ConfigurationMetadataRepositoryJsonBuilderFuzzer Job Type: libfuzzerasanspring-boot Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

CVE-2023-20873

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users...

CVE-2023-20873: Undefined Security Weakness

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users...

CVE-2023-20873

CVE-2023-20873 affects VMware Tanzu Spring Boot deployed in Cloud Foundry, enabling a security bypass due to a wildcard pattern matching flaw in Spring Boot’s access controls. Public references in the CVE describe impact on VMware Tanzu Spring Boot and related IBM deployments, with remediation th...

Security Bypass With Wildcard Pattern Matching on Cloud Foundry

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are true: NOTE:...

Spring Framework security vulnerabilities

Spring Framework is the U.S. Spring team of a set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications. Spring Boot has a security vulnerability that stems from a security bypass using wildcard pattern matching...

CVE-2023-20873

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users...

PT-2023-17684 · Unknown · Spring Boot

Name of the Vulnerable Software and Affected Versions: Spring Boot versions 3.0.0 through 3.0.5 Spring Boot versions 2.7.0 through 2.7.10 Spring Boot older unsupported versions Description: An application that is deployed to Cloud Foundry could be susceptible to a security bypass. Recommendations...

ai.ylyue:yue-library-auth-client (>=j11.2.6.0, <=j11.2.6.1), ai.ylyue:yue-library-auth-service (>=j11.2.6.0, <=j11.2.6.1) +1579 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=2.6.0, <=2.6.14)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =1.0.6, =1.0.6, =1.0.6, =1.0.7 and more Source cves: CVE-2023-20873 Source advisory:...