PT-2023-17684 · Unknown · Spring Boot

CVE-2023-20873 · Publicado 2023-04-20 · Atualizado 2023-08-28

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Boot versions 3.0.0 through 3.0.5 Spring Boot versions 2.7.0 through 2.7.10 Spring Boot older unsupported versions

Description An application that is deployed to Cloud Foundry could be susceptible to a security bypass.

Recommendations For Spring Boot versions 3.0.0 through 3.0.5, upgrade to 3.0.6 or later. For Spring Boot versions 2.7.0 through 2.7.10, upgrade to 2.7.11 or later. For Spring Boot older unsupported versions, upgrade to 3.0.6 or later, or 2.7.11 or later.

Exploit

Correção

Identificadores relacionados

CVE-2023-20873

GHSA-G5H3-W546-PJ7F

Produtos afetados

Spring Boot

Referências · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/20xxx/CVE-2023-20873.json · Exploit
• https://github.com/spring-projects/spring-boot · Nota
• https://github.com/spring-projects/spring-boot/commit/3522714c13b47af03bf42e7f2d5994af568cb1a7 · Nota
• https://github.com/spring-projects/spring-boot/releases/tag/v2.7.11 · Nota
• https://github.com/spring-projects/spring-boot/commit/32444fed4b51cc58dc908467f706102d7f0bfc15 · Nota
• https://github.com/spring-projects/spring-boot/releases/tag/v2.5.15 · Nota
• https://github.com/spring-projects/spring-boot/releases/tag/v3.0.6 · Nota
• https://github.com/spring-projects/spring-boot/releases/tag/v2.6.15 · Nota
• https://t.me/pentestingnews/36096 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-20873 · Nota de Segurança
• https://t.me/cibsecurity/62553 · Publicação no Telegram
• https://security.netapp.com/advisory/ntap-20230601-0009 · Nota
• https://spring.io/security/cve-2023-20873 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-20873 · Aviso do Fabricante
• https://t.me/pentestingnews/35228 · Publicação no Telegram