cn.bestwu.simpleframework:simpleframework-security (>=0.1.31, <=0.1.33), com.devonfw.cobigen:templates-devon4j (>=3.0.0, <=2021.12.006) +205 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.25.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.25.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - cn.bestwu.simpleframework:simpleframework-security =0.1.31, =3.0.0...

com.blitline:blitline-image-client-example (>=0.10.1, <=0.17.1), com.blitline:blitline-image-client-spring (>=0.10.1, <=0.17.1) +5 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.9.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.9.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - com.blitline:blitline-image-client-example =0.10.1, =0.10.1,...

com.epam.reportportal:agent-java-cucumber (2.6.1), com.epam.reportportal:agent-java-jbehave (2.6.0) +29 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.18.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.18.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - com.epam.reportportal:agent-java-cucumber 2.6.1 -...

cn.bestwu.simpleframework:simpleframework-security (>=0.1.12, <=0.1.17), co.bittub.api:core (1.0.0) +84 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.24.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.24.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - cn.bestwu.simpleframework:simpleframework-security =0.1.12, =1.0.0...

net.eusashead.hateoas:spring-halbuilder-page (1.0.0.release) potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.6.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.6.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - net.eusashead.hateoas:spring-halbuilder-page 1.0.0.release Source...

be.mogo.iam:mogo-provisioning (>=1.0.1.release, <=1.0.8.release), be.personify.iam:personify-api (>=1.0.0.release, <=1.0.8.release) +114 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.25.2.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.25.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - be.mogo.iam:mogo-provisioning =1.0.1.release, =1.0.0.release,...

org.springframework.data:spring-data-rest-core (2.0.3.release), org.springframework.data:spring-data-rest-webmvc (2.0.3.release) potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.13.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.13.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-core 2.0.3.release -...

gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin (>=0.0.1, <=0.0.8), org.springframework.boot:spring-boot-starter-data-rest (1.1.4.release) +5 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.14.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.14.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin...

io.springfox:springfox-data-rest (>=2.6.0, <=2.6.1), org.apache.geode:geode-web-api (>=1.0.0-incubating, <=1.1.1) potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.21.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.21.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.springfox:springfox-data-rest =2.6.0, =1.0.0-incubating, =1.1.1...

am.ik.home:uaa-client (>=1.3.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.3.0, <=1.9.0) +181 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.23.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.23.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - am.ik.home:uaa-client =1.3.0, =1.3.0, =1.3.0, =1.0.1.release,...

org.springframework.data:spring-data-rest-repository (1.0.0.release), org.springframework.data:spring-data-rest-webmvc (1.0.0.release) potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.3.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-repository 1.0.0.release ...

com.clusterra:clusterra-iam-application (>=1.1.0.release, <=1.2.1.release), com.clusterra:clusterra-iam-rest (>=1.1.0.release, <=1.2.1.release) +44 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.16.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.16.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - com.clusterra:clusterra-iam-application =1.1.0.release,...

be.personify.iam:personify-scim-server (>=2.1.0.release, <=2.1.2.release), com.angorasix:parent-pom-spring-kotlin (>=0.2.2, <=0.3.1) +41 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (2.1.0)

org.springframework.hateoas:spring-hateoas MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - be.personify.iam:personify-scim-server =2.1.0.release, =0.2.2, =4.1.5,...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.cr2, <=1.1.0.cr3), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.cr2, <=1.1.0.cr5) +3 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.12.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.12.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.cr2,...

io.springfox:springfox-core (>=2.0.1, <=2.1.2), io.springfox:springfox-petstore (>=2.0.1, <=2.1.2) +9 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.17.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.17.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.springfox:springfox-core =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.0.1...

be.personify.iam:personify-scim-server (>=2.1.0.release, <=2.1.2.release), com.angorasix:parent-pom-spring-kotlin (>=0.2.2, <=0.3.1) +41 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (2.1.0)

org.springframework.hateoas:spring-hateoas MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - be.personify.iam:personify-scim-server =2.1.0.release, =0.2.2, =4.1.5,...

com.bloxbean:bloxql-lib (0.0.1), com.fmarslan.struct-spring:fm-application (1.0.0) +154 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.25.1.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.25.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - com.bloxbean:bloxql-lib 0.0.1 -...

au.com.mountain-pass:hyperstate (>=1, <=9), cn.bestwu:data-rest (>=1.0.0.m1, <=1.0.0.m2) +72 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.19.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.19.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - au.com.mountain-pass:hyperstate =1, =1.0.0.m1, =1.0.0, =0.1.1,...

CVE-2023-34036

Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle and possibly discard...

Design/Logic Flaw

Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle and possibly discard...