PT-2023-17687 · Spring · Spring Boot

Martin Van Kervel Smedshammer · Publicado 2023-05-19 · Atualizado 2026-06-03 · CVE-2023-20883

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Spring Boot versions 2.5.0 through 2.5.14 Spring Boot versions 2.6.0 through 2.6.14 Spring Boot versions 2.7.0 through 2.7.11 Spring Boot versions 3.0.0 through 3.0.6 Spring Boot older unsupported versions

Description There is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache. An application is vulnerable if it has Spring MVC auto-configuration enabled, makes use of Spring Boot's welcome page support, and is deployed behind a proxy that caches 404 responses.

Recommendations For Spring Boot versions 2.5.x, upgrade to 2.5.15 or later. For Spring Boot versions 2.6.x, upgrade to 2.6.15 or later. For Spring Boot versions 2.7.x, upgrade to 2.7.12 or later. For Spring Boot versions 3.0.x, upgrade to 3.0.7 or later. For older, unsupported Spring Boot versions, upgrade to 3.0.7 or 2.7.12 or later. As a temporary workaround, consider configuring the reverse proxy not to cache 404 responses and/or not to cache responses to requests to the root (/) of the application.

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2023-20883

GHSA-XF96-W227-R7C4

Produtos afetados

Spring Boot

Referências · 14

• https://github.com/spring-projects/spring-boot · Nota
• https://github.com/spring-projects/spring-boot/issues/35552 · Nota
• https://github.com/spring-projects/spring-boot/releases/tag/v2.7.12 · Nota
• https://github.com/spring-projects/spring-boot/commit/418dd1ba5bdad79b55a043000164bfcbda2acd78 · Nota
• https://github.com/spring-projects/spring-boot/releases/tag/v2.5.15 · Nota
• https://github.com/spring-projects/spring-boot/releases/tag/v2.6.15 · Nota
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2023-20883 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-20883 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20230703-0008 · Nota
• https://t.me/pentestingnews/36096 · Publicação no Telegram
• https://t.me/cvenotify/53562 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-20883 · Nota de Segurança
• https://spring.io/security/cve-2023-20883 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-xf96-w227-r7c4 · Aviso do Fabricante