com.sap.cds:cds-starter-cloudfoundry (>=2.0.1, <=2.4.0), com.sap.cds:cds-starter-k8s (>=2.0.1, <=2.4.0) +2 more potentially affected by CVE-2023-50422 via com.sap.cloud.security.xsuaa:spring-xsuaa (>=3.0.0, <=3.2.1)

com.sap.cloud.security.xsuaa:spring-xsuaa MAVEN version =3.0.0, =2.0.1, =2.0.1, =3.0.0, =3.0.0, =3.2.1 Source cves: CVE-2023-50422 Source advisory: GHSA-59C9-PXQ8-9C73...

com.sap.cloud.security:resourceserver-security-spring-boot-starter (0.1.1) potentially affected by CVE-2023-50422 +1 more via com.sap.cloud.security:spring-security (0.1.1)

com.sap.cloud.security:spring-security MAVEN version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.sap.cloud.security:spring-security and may be impacted: - com.sap.cloud.security:resourceserver-security-spring-boot-starter 0.1.1 Source cve...

com.sap.cloud.security:resourceserver-security-spring-boot-starter (0.1.4) potentially affected by CVE-2023-50422 +1 more via com.sap.cloud.security:spring-security (0.1.4)

com.sap.cloud.security:spring-security MAVEN version 0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.sap.cloud.security:spring-security and may be impacted: - com.sap.cloud.security:resourceserver-security-spring-boot-starter 0.1.4 Source cve...

com.sap.cloud.security:resourceserver-security-spring-boot-starter (0.1.6) potentially affected by CVE-2023-50422 +1 more via com.sap.cloud.security:spring-security (0.1.6)

com.sap.cloud.security:spring-security MAVEN version 0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.sap.cloud.security:spring-security and may be impacted: - com.sap.cloud.security:resourceserver-security-spring-boot-starter 0.1.6 Source cve...

com.sap.cloud.security:resourceserver-security-spring-boot-starter (0.1.7) potentially affected by CVE-2023-50422 +1 more via com.sap.cloud.security:spring-security (0.1.7)

com.sap.cloud.security:spring-security MAVEN version 0.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.sap.cloud.security:spring-security and may be impacted: - com.sap.cloud.security:resourceserver-security-spring-boot-starter 0.1.7 Source cve...

com.sap.cloud.security:resourceserver-security-spring-boot-starter (0.2.0) potentially affected by CVE-2023-50422 +1 more via com.sap.cloud.security:spring-security (0.2.0)

com.sap.cloud.security:spring-security MAVEN version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.sap.cloud.security:spring-security and may be impacted: - com.sap.cloud.security:resourceserver-security-spring-boot-starter 0.2.0 Source cve...

com.sap.cds:cds-starter-cloudfoundry (>=2.2.0, <=2.4.0), com.sap.cds:cds-starter-k8s (>=2.2.0, <=2.4.0) +5 more potentially affected by CVE-2023-50422 +1 more via com.sap.cloud.security:spring-security (>=3.0.0, <=3.2.1)

com.sap.cloud.security:spring-security MAVEN version =3.0.0, =2.2.0, =2.2.0, =1.0.4, =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.4.0 Source cves: CVE-2023-50422, CVE-2023-50424 Source advisory: OSV:GHSA-59C9-PXQ8-9C73...

com.sap.cds:cds-starter-cloudfoundry (>=2.2.0, <=2.4.0), com.sap.cds:cds-starter-k8s (>=2.2.0, <=2.4.0) +5 more potentially affected by CVE-2023-50422 via com.sap.cloud.security:spring-security (>=3.0.0, <=3.2.1)

com.sap.cloud.security:spring-security MAVEN version =3.0.0, =2.2.0, =2.2.0, =1.0.4, =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.4.0 Source cves: CVE-2023-50422 Source advisory: GHSA-59C9-PXQ8-9C73...

IceCMS Security Vulnerability

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation by NgShow individual developers. A security vulnerability exists in IceCMS version 2.0.1, which originates from the presence of an unknown part of /WebResource/resource in the Love Handler component...

IceCMS Information Disclosure Vulnerability

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation of NgShow individual developers. An information leakage vulnerability exists in IceCMS version 2.0.1, which originates from the presence of an unknown function in /adplanet/PlanetUser in the API...

com.sap.cloud.security:resourceserver-security-spring-boot-starter (>=0.1.0, <=2.16.0) potentially affected by CVE-2023-50422 via com.sap.cloud.security:spring-security (>=0.1.0, <=2.16.0)

com.sap.cloud.security:spring-security MAVEN version =0.1.0, =0.1.0, =2.16.0 Source cves: CVE-2023-50422 Source advisory: MEND:CVE-2023-50422...

com.sap.cds:cds-starter-cloudfoundry (>=2.2.0, <=2.4.0), com.sap.cds:cds-starter-k8s (>=2.2.0, <=2.4.0) +5 more potentially affected by CVE-2023-50422 via com.sap.cloud.security:spring-security (>=3.0.0, <=3.2.1)

com.sap.cloud.security:spring-security MAVEN version =3.0.0, =2.2.0, =2.2.0, =1.0.4, =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.4.0 Source cves: CVE-2023-50422 Source advisory: MEND:CVE-2023-50422...

com.sap.cds:cds-starter-cloudfoundry (>=2.0.1, <=2.4.0), com.sap.cds:cds-starter-k8s (>=2.0.1, <=2.4.0) +2 more potentially affected by CVE-2023-50422 via com.sap.cloud.security.xsuaa:spring-xsuaa (>=3.0.0, <=3.2.1)

com.sap.cloud.security.xsuaa:spring-xsuaa MAVEN version =3.0.0, =2.0.1, =2.0.1, =3.0.0, =3.0.0, =3.2.1 Source cves: CVE-2023-50422 Source advisory: MEND:CVE-2023-50422...

This Week in Spring - December 12th, 2023

Hi, Spring fans! Welcome to a new installment of This Week in Spring! We've got a ton of stuff to get into, so let's dive right in! Laur Spilca and I look at how to ugprade a Spring Security 5.x application to Spring Security 6.x. Apache SkyWalking with Sheng Wu and Apache ShardingSphere with...

cn.vonce:vonce-sqlbean (0.9.6), com.github.fangjinuo.sqlhelper:sqlhelper-jfinal (>=2.0.0, <=3.1.0) +5 more potentially affected by CVE-2023-49487 via com.jfinal:jfinal (4.3)

com.jfinal:jfinal MAVEN version 4.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.vonce:vonce-sqlbean 0.9.6 - com.github.fangjinuo.sqlhelper:sqlhelper-jfinal =2.0.0, =2.1.3, =2.1.6 - net.dreamlu:jfinal-even...

com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1), com.jfinal:jfinal-undertow (1.9) potentially affected by CVE-2023-49487 via com.jfinal:jfinal (4.4)

com.jfinal:jfinal MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.artislong:jfinal-spring-boot-starter =1.0, =2.1 - com.jfinal:jfinal-undertow 1.9 Source cves: CVE-2023-49487 Source...

com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1), com.jfinal:jfinal-undertow (1.9) potentially affected by CVE-2023-49486 via com.jfinal:jfinal (4.4)

com.jfinal:jfinal MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.artislong:jfinal-spring-boot-starter =1.0, =2.1 - com.jfinal:jfinal-undertow 1.9 Source cves: CVE-2023-49486 Source...

com.jfinal:jfinal-undertow (2.0), com.jfinal:jfinal-weixin (2.5) +5 more potentially affected by CVE-2023-49487 via com.jfinal:jfinal (4.8)

com.jfinal:jfinal MAVEN version 4.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-undertow 2.0 - com.jfinal:jfinal-weixin 2.5 - io.jboot:jboot =2.3.1, =3.1.0, =3.5.8.v20191228-release, =0.0.1...

com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1), com.jfinal:jfinal-undertow (1.9) potentially affected by CVE-2023-49485 via com.jfinal:jfinal (4.4)

com.jfinal:jfinal MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.artislong:jfinal-spring-boot-starter =1.0, =2.1 - com.jfinal:jfinal-undertow 1.9 Source cves: CVE-2023-49485 Source...

spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry

A flaw was found in Spring Boot. This targets specifically 'spring-boot-actuator-autoconfigure' package. This issue occurs when an application is deployed to Cloud Foundry, which could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are...