Improper Access Control

🗓️ 22 Jul 2023 20:03:13Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 26 Views

org.springframework.security:spring-security-config vulnerable to Improper Access Control due to lack of checks in multiple files, enabling attacker to use `**` pattern in WebFlux configurations, leading to security bypass

Reporter	Title	Published	Views	Family All 50
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.2 fixes multiple security vulnerabilities	6 Oct 202316:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	30 Jan 202404:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2 Web Query for i is vulnerable to a remote attacker bypassing security restrictions or to denial of service.	14 Mar 202414:17	–	ibm
IBM Security Bulletins	Security Bulletin: Common vulnerabilities addressed in Cloudera Data Platform 7.1.9 HF2	26 Mar 202503:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager August 2023 - Multiple CVEs addressed	15 Sep 202308:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring Security affects IBM Process Mining . Multiple CVEs	11 Oct 202309:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in VMware Tanzu Spring Security	29 Nov 202301:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Automation Decision Services November 2023 - Multiple CVEs addressed	12 Dec 202317:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for November 2023.	26 Mar 202504:08	–	ibm
IBM Security Bulletins	Security Bulletin: VMware Tanzu Spring Security is vulnerable to CVE-2023-34034 and CVE-2023-34035 used in IBM Maximo Application Suite - Monitor Component	26 Sep 202318:30	–	ibm

Vulners

Node

springframework spring-security-configRange6.1.0-M1–6.1.1java

springframework spring-security-configRange6.0.0-M1–6.0.4java

springframework spring-security-configRange5.8.0-M1–5.8.4java

springframework spring-security-configRange5.7.0-M1–5.7.9java

springframework spring-security-configRange5.0.0.M1–5.6.11java

springframework spring-security-configRange6.1.0-M1–6.1.1java

springframework spring-security-configRange6.0.0-M1–6.0.4java

springframework spring-security-configRange5.8.0-M1–5.8.4java

springframework spring-security-configRange5.7.0-M1–5.7.9java

springframework spring-security-configRange5.6.0-M1–5.6.11java

Source	Link
spring	www.spring.io/security/cve-2023-34034
github	www.github.com/spring-projects/spring-security/commit/7813a9ba26e53fe54e4d2ec6eb076126e8550780
github	www.github.com/advisories/GHSA-3h6f-g5f3-gc4w
security	www.security.netapp.com/advisory/ntap-20230814-0008/

14 Aug 2023 20:42Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.19.1 - 9.8

EPSS0.4929

SSVC