Ubuntu.comUB:CVE-2023-34053CVE-2023-34053
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.7 Medium
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
16.4%
In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to
provide specially crafted HTTP requests that may cause a denial-of-service
(DoS) condition. Specifically, an application is vulnerable when all of the
following are true: * the application uses Spring MVC or Spring WebFlux *
io.micrometer:micrometer-core is on the classpath * an ObservationRegistry
is configured in the application to record observations Typically, Spring
Boot applications need the org.springframework.boot:spring-boot-actuator
dependency to meet all conditions.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | libspring-java | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | libspring-java | < any | UNKNOWN |
| ubuntu | 22.04 | noarch | libspring-java | < any | UNKNOWN |
| ubuntu | 23.10 | noarch | libspring-java | < any | UNKNOWN |
| ubuntu | 24.04 | noarch | libspring-java | < any | UNKNOWN |
| ubuntu | 14.04 | noarch | libspring-java | < any | UNKNOWN |
| ubuntu | 16.04 | noarch | libspring-java | < any | UNKNOWN |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.7 Medium
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
16.4%