Spring Security Configuration Error Auth Bypass Info Disclosure

The vulnerability of the Java framework for securing industrial applications using Spring Security is related to errors in authentication configuration. These errors can occur when using multiple servlets, including the DispatcherServlet in Spring MVC. Exploiting this vulnerability allows a...

Spring Security Template Injection

The vulnerability of the Java framework for securing industrial applications using Spring Security is related to the use of “” as a template in the Spring Security configuration for WebFlux. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remote...

VMware Spring Security security vulnerability

VMware Spring Security is a suite of security frameworks from VMware that provide illustrative security protection for Spring-based applications. A security vulnerability exists in VMware Spring Security that stems from the presence of a pattern matching mismatch that could lead to a security...

Spring Security's authorization rules can be misconfigured when using multiple servlets

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

br.com.nitertech:jwt (>=1.1.4.2, <=1.1.5), cn.herodotus.engine:oauth2-sdk-authentication (>=3.0.6.4, <=3.1.1.3) +314 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=6.1.0, <=6.1.1)

org.springframework.security:spring-security-config MAVEN version =6.1.0, =1.1.4.2, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.0.6.4, =4.0.1, =4.0.1, =0.1.0, =6.1.11, =6.1.11, =7.0.0, =7.0.0, =6.1.11, =6.1.11, =6.2.0 and more Source cves: CVE-2023-34035 Source advisory: OSV:GHSA-4VPR-XFRP-CJ64...

cc.vihackerframework:vihacker-security-starter (1.0.8.r), city.smartb.fs:f2-spring-boot-starter-auth-tenant (>=0.15.0-rc1, <=0.15.0) +400 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=6.0.0, <=6.0.4)

org.springframework.security:spring-security-config MAVEN version =6.0.0, =0.15.0-rc1, =0.12.0, =0.12.0, =0.15.0-rc1, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =2023.0.0.2-alpha.1, =2023.0.0.0, =2023.0.0.1, =2023.0.0.2-alpha.2 and more Source cves: CVE-2023-34035 Source...

com.erudika:para-jar (>=1.48.0, <=1.48.2), com.erudika:para-server (>=1.48.0, <=1.48.2) +120 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=5.8.0, <=5.8.4)

org.springframework.security:spring-security-config MAVEN version =5.8.0, =1.48.0, =1.48.0, =1.48.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =1.3.1, =1.3.2 - com.gitlab.summer-cattle:cattle-addons-wechat-starter 0.0.5 and more Source cves: CVE-2023-34035 Source advisory: GHSA-4VPR-XFRP-CJ64...

GHSA-4VPR-XFRP-CJ64 Spring Security's authorization rules can be misconfigured when using multiple servlets

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

cc.vihackerframework:vihacker-security-starter (1.0.8.r), city.smartb.fs:f2-spring-boot-starter-auth-tenant (>=0.15.0-rc1, <=0.15.0) +400 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=6.0.0, <=6.0.4)

org.springframework.security:spring-security-config MAVEN version =6.0.0, =0.15.0-rc1, =0.12.0, =0.12.0, =0.15.0-rc1, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =2023.0.0.2-alpha.1, =2023.0.0.0, =2023.0.0.1, =2023.0.0.2-alpha.2 and more Source cves: CVE-2023-34035 Source...

br.com.nitertech:jwt (>=1.1.4.2, <=1.1.5), cn.herodotus.engine:oauth2-sdk-authentication (>=3.0.6.4, <=3.1.1.3) +314 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=6.1.0, <=6.1.1)

org.springframework.security:spring-security-config MAVEN version =6.1.0, =1.1.4.2, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.0.6.4, =4.0.1, =4.0.1, =0.1.0, =6.1.11, =6.1.11, =7.0.0, =7.0.0, =6.1.11, =6.1.11, =6.2.0 and more Source cves: CVE-2023-34035 Source advisory: GHSA-4VPR-XFRP-CJ64...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

Authorization

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

cc.vihackerframework:vihacker-security-starter (1.0.8.r), city.smartb.fs:f2-spring-boot-starter-auth-tenant (>=0.15.0-rc1, <=0.15.0) +400 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=6.0.0, <=6.0.4)

org.springframework.security:spring-security-config MAVEN version =6.0.0, =0.15.0-rc1, =0.12.0, =0.12.0, =0.15.0-rc1, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =2023.0.0.2-alpha.1, =2023.0.0.0, =2023.0.0.1, =2023.0.0.2-alpha.2 and more Source cves: CVE-2023-34035 Source...

br.com.nitertech:jwt (>=1.1.4.2, <=1.1.5), cn.herodotus.engine:oauth2-sdk-authentication (>=3.0.6.4, <=3.1.1.3) +314 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=6.1.0, <=6.1.1)

org.springframework.security:spring-security-config MAVEN version =6.1.0, =1.1.4.2, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.0.6.4, =4.0.1, =4.0.1, =0.1.0, =6.1.11, =6.1.11, =7.0.0, =7.0.0, =6.1.11, =6.1.11, =6.2.0 and more Source cves: CVE-2023-34035 Source advisory: MEND:CVE-2023-34035...

com.erudika:para-jar (>=1.48.0, <=1.48.2), com.erudika:para-server (>=1.48.0, <=1.48.2) +120 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=5.8.0, <=5.8.4)

org.springframework.security:spring-security-config MAVEN version =5.8.0, =1.48.0, =1.48.0, =1.48.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =1.3.1, =1.3.2 - com.gitlab.summer-cattle:cattle-addons-wechat-starter 0.0.5 and more Source cves: CVE-2023-34035 Source advisory: MEND:CVE-2023-34035...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

CVE-2023-34035

CVE-2023-34035 is a Spring Security authorization misconfiguration affecting Spring MVC apps that use requestMatchers(String) to reference endpoints and secure more than one servlet (including DispatcherServlet). The underlying issue is a misconfiguration that can occur when non-Spring MVC endpoi...

CVE-2023-34035: Incorrect Authorization

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

PT-2023-3579

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.8 prior to 5.8.5 Spring Security versions 6.0 prior to 6.0.5 Spring Security versions 6.1 prior to 6.1.2 Description The issue is related to authorization rule misconfiguration in Spring Security when using multiple...