CVE-2023-34034

CVE-2023-34034 is documented in IBM security bulletins as affecting VMware Tanzu Spring Security when using "**" as a pattern in WebFlux configuration, causing a pattern-matching bypass. The IBM bulletin assigns a CVSS v3.0 base score of 9.1 (Impact: Confidentiality High, Integrity High, Availabi...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.ylyue:yue-library-auth-client (>=j11.2.6.0, <=j11.2.6.1) +1183 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=5.6.0, <=5.6.10)

org.springframework.security:spring-security-config MAVEN version =5.6.0, =4.4.0.2, =j11.2.6.0, =j11.2.6.0, =0.2.0, =0.8.3, =2.1.0.m8, =1.0.0, =2.7.0.beta4, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta1, =2.7.0.beta1, =2.7.0.beta1, =2.7.0.beta2 and more Source cves: CVE-2023-34034 Source advisory:...

com.erudika:para-jar (>=1.48.0, <=1.48.2), com.erudika:para-server (>=1.48.0, <=1.48.2) +120 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=5.8.0, <=5.8.4)

org.springframework.security:spring-security-config MAVEN version =5.8.0, =1.48.0, =1.48.0, =1.48.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =1.3.1, =1.3.2 - com.gitlab.summer-cattle:cattle-addons-wechat-starter 0.0.5 and more Source cves: CVE-2023-34034 Source advisory: MEND:CVE-2023-34034...

cc.vihackerframework:vihacker-security-starter (1.0.8.r), city.smartb.fs:f2-spring-boot-starter-auth-tenant (>=0.15.0-rc1, <=0.15.0) +400 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=6.0.0, <=6.0.4)

org.springframework.security:spring-security-config MAVEN version =6.0.0, =0.15.0-rc1, =0.12.0, =0.12.0, =0.15.0-rc1, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =2023.0.0.2-alpha.1, =2023.0.0.0, =2023.0.0.1, =2023.0.0.2-alpha.2 and more Source cves: CVE-2023-34034 Source...

br.com.nitertech:jwt (>=1.1.4.2, <=1.1.5), cn.herodotus.engine:oauth2-sdk-authentication (>=3.0.6.4, <=3.1.1.3) +314 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=6.1.0, <=6.1.1)

org.springframework.security:spring-security-config MAVEN version =6.1.0, =1.1.4.2, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.0.6.4, =4.0.1, =4.0.1, =0.1.0, =6.1.11, =6.1.11, =7.0.0, =7.0.0, =6.1.11, =6.1.11, =6.2.0 and more Source cves: CVE-2023-34034 Source advisory: MEND:CVE-2023-34034...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.3.0), cc.hiver:hiver-core (>=1.0, <=1.0.4) +1266 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=5.7.0, <=5.7.9)

org.springframework.security:spring-security-config MAVEN version =5.7.0, =5.3.1, =1.0, =0.0.1, =2.0.1, =0.2.2, =0.0.1-alpha.1, =2.7.7.3, =2.7.7.4, =2.7.0.0, =2.7.0.0, =2.7.7.3 and more Source cves: CVE-2023-34034 Source advisory: MEND:CVE-2023-34034...

VMware Spring Security security vulnerability

VMware Spring Security is a suite of security frameworks from VMware that provide illustrative security protection for Spring-based applications. A security vulnerability exists in VMware Spring Security that stems from the presence of a pattern matching mismatch that could lead to a security...

Spring Security Template Injection

The vulnerability of the Java framework for securing industrial applications using Spring Security is related to the use of “” as a template in the Spring Security configuration for WebFlux. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remote...

Spring Security Configuration Error Auth Bypass Info Disclosure

The vulnerability of the Java framework for securing industrial applications using Spring Security is related to errors in authentication configuration. These errors can occur when using multiple servlets, including the DispatcherServlet in Spring MVC. Exploiting this vulnerability allows a...

CVE-2023-34034: Improper Preservation of Permissions

Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...

GHSA-4VPR-XFRP-CJ64 Spring Security's authorization rules can be misconfigured when using multiple servlets

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

Spring Security's authorization rules can be misconfigured when using multiple servlets

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

cc.vihackerframework:vihacker-security-starter (1.0.8.r), city.smartb.fs:f2-spring-boot-starter-auth-tenant (>=0.15.0-rc1, <=0.15.0) +400 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=6.0.0, <=6.0.4)

org.springframework.security:spring-security-config MAVEN version =6.0.0, =0.15.0-rc1, =0.12.0, =0.12.0, =0.15.0-rc1, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =2023.0.0.2-alpha.1, =2023.0.0.0, =2023.0.0.1, =2023.0.0.2-alpha.2 and more Source cves: CVE-2023-34035 Source...

br.com.nitertech:jwt (>=1.1.4.2, <=1.1.5), cn.herodotus.engine:oauth2-sdk-authentication (>=3.0.6.4, <=3.1.1.3) +314 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=6.1.0, <=6.1.1)

org.springframework.security:spring-security-config MAVEN version =6.1.0, =1.1.4.2, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.0.6.4, =4.0.1, =4.0.1, =0.1.0, =6.1.11, =6.1.11, =7.0.0, =7.0.0, =6.1.11, =6.1.11, =6.2.0 and more Source cves: CVE-2023-34035 Source advisory: OSV:GHSA-4VPR-XFRP-CJ64...

br.com.nitertech:jwt (>=1.1.4.2, <=1.1.5), cn.herodotus.engine:oauth2-sdk-authentication (>=3.0.6.4, <=3.1.1.3) +314 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=6.1.0, <=6.1.1)

org.springframework.security:spring-security-config MAVEN version =6.1.0, =1.1.4.2, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.0.6.4, =4.0.1, =4.0.1, =0.1.0, =6.1.11, =6.1.11, =7.0.0, =7.0.0, =6.1.11, =6.1.11, =6.2.0 and more Source cves: CVE-2023-34035 Source advisory: GHSA-4VPR-XFRP-CJ64...

com.erudika:para-jar (>=1.48.0, <=1.48.2), com.erudika:para-server (>=1.48.0, <=1.48.2) +120 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=5.8.0, <=5.8.4)

org.springframework.security:spring-security-config MAVEN version =5.8.0, =1.48.0, =1.48.0, =1.48.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =1.3.1, =1.3.2 - com.gitlab.summer-cattle:cattle-addons-wechat-starter 0.0.5 and more Source cves: CVE-2023-34035 Source advisory: GHSA-4VPR-XFRP-CJ64...

cc.vihackerframework:vihacker-security-starter (1.0.8.r), city.smartb.fs:f2-spring-boot-starter-auth-tenant (>=0.15.0-rc1, <=0.15.0) +400 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=6.0.0, <=6.0.4)

org.springframework.security:spring-security-config MAVEN version =6.0.0, =0.15.0-rc1, =0.12.0, =0.12.0, =0.15.0-rc1, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =2023.0.0.2-alpha.1, =2023.0.0.0, =2023.0.0.1, =2023.0.0.2-alpha.2 and more Source cves: CVE-2023-34035 Source...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

Authorization

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...