cc.vihackerframework:vihacker-security-starter (=1.0.8.R), city.smartb.fs:f2-spring-boot-starter-auth-tenant (>=0.15.0 <=0.15.0-RC2) +399 more potentially affected by CVE-2023-34034 via org.springframework.security:spring-security-config (>=6.0.0 <=6.0.4)

org.springframework.security:spring-security-config MAVEN version =6.0.0, =0.15.0, =0.12.0, =0.12.0, =0.15.0, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =2023.0.0.2-alpha.1, =2023.0.0.0, =2023.0.0.1, =2023.0.0.2-alpha.2 and more Source cves: CVE-2023-34034 Source advisory...

CVE-2023-34034

Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...

CVE-2023-34034

Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...

Security feature bypass

Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...

CVE-2023-34034

CVE-2023-34034 is documented in IBM security bulletins as affecting VMware Tanzu Spring Security when using "**" as a pattern in WebFlux configuration, causing a pattern-matching bypass. The IBM bulletin assigns a CVSS v3.0 base score of 9.1 (Impact: Confidentiality High, Integrity High, Availabi...

CVE-2023-34034

Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...

CVE-2023-34034

Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass...

VMware Spring Security 安全漏洞

VMware Spring Security is a suite of security frameworks from VMware that provide illustrative security protection for Spring-based applications. A security vulnerability exists in VMware Spring Security that stems from the presence of a pattern matching mismatch that could lead to a security...

The vulnerability of the Java framework for securing industrial applications, Spring Security, is related to the use of “***” as a template in the Spring Security configuration for WebFlux. This allows attackers to circumvent existing security restrictions.

The vulnerability of the Java framework for securing industrial applications using Spring Security is related to the use of “” as a template in the Spring Security configuration for WebFlux. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remote...

The vulnerability of the Java framework for securing industrial applications using Spring Security stems from configuration errors related to authentication. These errors can occur when using multiple servlets, including the DispatcherServlet in Spring MVC. This vulnerability allows attackers to expose sensitive information and enhance their privileges.

The vulnerability of the Java framework for securing industrial applications using Spring Security is related to errors in authentication configuration. These errors can occur when using multiple servlets, including the DispatcherServlet in Spring MVC. Exploiting this vulnerability allows a...

GHSA-4VPR-XFRP-CJ64 Spring Security's authorization rules can be misconfigured when using multiple servlets

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

Spring Security's authorization rules can be misconfigured when using multiple servlets

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

br.com.nitertech:jwt (>=1.1.4.2 <=1.1.5), cn.herodotus.engine:oauth2-sdk-authentication (>=3.0.6.4 <=3.1.1.3) +314 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=6.1.0 <=6.1.1)

org.springframework.security:spring-security-config MAVEN version =6.1.0, =1.1.4.2, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.0.6.4, =4.0.1, =4.0.1, =0.1.0, =6.1.11, =6.1.11, =7.0.0, =7.0.0, =6.1.11, =6.1.11, =6.2.0 and more Source cves: CVE-2023-34035 Source advisory: OSV:GHSA-4VPR-XFRP-CJ64...

cc.chensoul.nacos:nacos-distribution (=2.5.2), com.buession.security:buession-security-spring (>=3.0.0 <=3.0.1) +262 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=5.8.0 <=5.8.4)

org.springframework.security:spring-security-config MAVEN version =5.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.12.0, =5.12.0, =1.48.0, =1.48.0, =1.48.0, =4.5.0, =4.5.0, =4.5.0, =6.5.0, =4.5.0, =4.5.1 and more Source cves: CVE-2023-34035 Source advisory: OSV:GHSA-4VPR-XFRP-CJ64...

cc.vihackerframework:vihacker-security-starter (=1.0.8.R), city.smartb.fs:f2-spring-boot-starter-auth-tenant (>=0.15.0 <=0.15.0-RC2) +399 more potentially affected by CVE-2023-34035 via org.springframework.security:spring-security-config (>=6.0.0 <=6.0.4)

org.springframework.security:spring-security-config MAVEN version =6.0.0, =0.15.0, =0.12.0, =0.12.0, =0.15.0, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =2023.0.0.2-alpha.1, =2023.0.0.0, =2023.0.0.1, =2023.0.0.2-alpha.2 and more Source cves: CVE-2023-34035 Source advisory...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

Authorization

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

CVE-2023-34035

CVE-2023-34035 is a Spring Security authorization misconfiguration affecting Spring MVC apps that use requestMatchers(String) to reference endpoints and secure more than one servlet (including DispatcherServlet). The underlying issue is a misconfiguration that can occur when non-Spring MVC endpoi...

PT-2023-3578 · Spring · Spring Webflux

Name of the Vulnerable Software and Affected Versions: Spring WebFlux versions affected versions not specified Description: Using "" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a...