2837 matches found
Access Control Bypass in Spring Security
Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...
com.erudika:para-jar (>=1.48.0, <=1.48.2), com.erudika:para-server (>=1.48.0, <=1.48.2) +120 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=5.8.0, <=5.8.4)
org.springframework.security:spring-security-config MAVEN version =5.8.0, =1.48.0, =1.48.0, =1.48.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =1.3.1, =1.3.2 - com.gitlab.summer-cattle:cattle-addons-wechat-starter 0.0.5 and more Source cves: CVE-2023-34034 Source advisory: GHSA-3H6F-G5F3-GC4W...
com.erudika:para-jar (>=1.48.0, <=1.48.2), com.erudika:para-server (>=1.48.0, <=1.48.2) +120 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=5.8.0, <=5.8.4)
org.springframework.security:spring-security-config MAVEN version =5.8.0, =1.48.0, =1.48.0, =1.48.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =1.3.1, =1.3.2 - com.gitlab.summer-cattle:cattle-addons-wechat-starter 0.0.5 and more Source cves: CVE-2023-34034 Source advisory: OSV:GHSA-3H6F-G5F3-GC4W...
GHSA-3H6F-G5F3-GC4W Access Control Bypass in Spring Security
Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...
br.com.nitertech:jwt (>=1.1.4.2, <=1.1.5), cn.herodotus.engine:oauth2-sdk-authentication (>=3.0.6.4, <=3.1.1.3) +314 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=6.1.0, <=6.1.1)
org.springframework.security:spring-security-config MAVEN version =6.1.0, =1.1.4.2, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.0.6.4, =4.0.1, =4.0.1, =0.1.0, =6.1.11, =6.1.11, =7.0.0, =7.0.0, =6.1.11, =6.1.11, =6.2.0 and more Source cves: CVE-2023-34034 Source advisory: OSV:GHSA-3H6F-G5F3-GC4W...
cc.vihackerframework:vihacker-security-starter (1.0.8.r), city.smartb.fs:f2-spring-boot-starter-auth-tenant (>=0.15.0-rc1, <=0.15.0) +400 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=6.0.0, <=6.0.4)
org.springframework.security:spring-security-config MAVEN version =6.0.0, =0.15.0-rc1, =0.12.0, =0.12.0, =0.15.0-rc1, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =2023.0.0.2-alpha.1, =2023.0.0.0, =2023.0.0.1, =2023.0.0.2-alpha.2 and more Source cves: CVE-2023-34034 Source...
ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.ylyue:yue-library-auth-client (>=j11.2.6.0, <=j11.2.6.1) +1185 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=5.6.0, <=5.6.10)
org.springframework.security:spring-security-config MAVEN version =5.6.0, =4.4.0.2, =j11.2.6.0, =j11.2.6.0, =0.2.0, =0.8.3, =2.1.0.m8, =1.0.0, =2.7.0.beta4, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta1, =2.7.0.beta1, =2.7.0.beta1, =2.7.0.beta2 and more Source cves: CVE-2023-34034 Source advisory:...
CVE-2023-34034
Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...
CVE-2023-34034
Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...
Security feature bypass
Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...
ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.ylyue:yue-library-auth-client (>=j11.2.6.0, <=j11.2.6.1) +1185 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=5.6.0, <=5.6.10)
org.springframework.security:spring-security-config MAVEN version =5.6.0, =4.4.0.2, =j11.2.6.0, =j11.2.6.0, =0.2.0, =0.8.3, =2.1.0.m8, =1.0.0, =2.7.0.beta4, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta1, =2.7.0.beta1, =2.7.0.beta1, =2.7.0.beta2 and more Source cves: CVE-2023-34034 Source advisory:...
CVE-2023-34034
Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...
cc.vihackerframework:vihacker-security-starter (1.0.8.r), city.smartb.fs:f2-spring-boot-starter-auth-tenant (>=0.15.0-rc1, <=0.15.0) +400 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=6.0.0, <=6.0.4)
org.springframework.security:spring-security-config MAVEN version =6.0.0, =0.15.0-rc1, =0.12.0, =0.12.0, =0.15.0-rc1, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =2023.0.0.2-alpha.1, =2023.0.0.0, =2023.0.0.1, =2023.0.0.2-alpha.2 and more Source cves: CVE-2023-34034 Source...
com.erudika:para-jar (>=1.48.0, <=1.48.2), com.erudika:para-server (>=1.48.0, <=1.48.2) +120 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=5.8.0, <=5.8.4)
org.springframework.security:spring-security-config MAVEN version =5.8.0, =1.48.0, =1.48.0, =1.48.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =1.3.1, =1.3.2 - com.gitlab.summer-cattle:cattle-addons-wechat-starter 0.0.5 and more Source cves: CVE-2023-34034 Source advisory: MEND:CVE-2023-34034...
br.com.nitertech:jwt (>=1.1.4.2, <=1.1.5), cn.herodotus.engine:oauth2-sdk-authentication (>=3.0.6.4, <=3.1.1.3) +314 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=6.1.0, <=6.1.1)
org.springframework.security:spring-security-config MAVEN version =6.1.0, =1.1.4.2, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.0.6.4, =4.0.1, =4.0.1, =0.1.0, =6.1.11, =6.1.11, =7.0.0, =7.0.0, =6.1.11, =6.1.11, =6.2.0 and more Source cves: CVE-2023-34034 Source advisory: MEND:CVE-2023-34034...
CVE-2023-34034
Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...
au.csiro.pathling:fhir-server (>=5.3.1, <=6.3.0), cc.hiver:hiver-core (>=1.0, <=1.0.4) +1266 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=5.7.0, <=5.7.9)
org.springframework.security:spring-security-config MAVEN version =5.7.0, =5.3.1, =1.0, =0.0.1, =2.0.1, =0.2.2, =0.0.1-alpha.1, =2.7.7.3, =2.7.7.4, =2.7.0.0, =2.7.0.0, =2.7.7.3 and more Source cves: CVE-2023-34034 Source advisory: MEND:CVE-2023-34034...
CVE-2023-34034
Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...
CVE-2023-34034
CVE-2023-34034 is documented in IBM security bulletins as affecting VMware Tanzu Spring Security when using "**" as a pattern in WebFlux configuration, causing a pattern-matching bypass. The IBM bulletin assigns a CVSS v3.0 base score of 9.1 (Impact: Confidentiality High, Integrity High, Availabi...
CVE-2023-34034: Improper Preservation of Permissions
Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...