PT-2023-2099 · Spring+1 · Spring Framework+1
CVE-2023-20861
·
Publicado
2023-03-23
·
Atualizado
2026-06-22
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Spring Framework versions 5.2.0.RELEASE through 5.2.22.RELEASE
Spring Framework versions 5.3.0 through 5.3.25
Spring Framework versions 6.0.0 through 6.0.6
Description
The issue is related to unlimited resource distribution in the Spring Framework, which can be exploited by a remote attacker using specially crafted SpEL expressions to cause a denial-of-service (DoS) condition.
Recommendations
For Spring Framework versions 5.2.0.RELEASE through 5.2.22.RELEASE, update to a version outside of this range to resolve the issue.
For Spring Framework versions 5.3.0 through 5.3.25, update to a version outside of this range to resolve the issue.
For Spring Framework versions 6.0.0 through 6.0.6, update to a version outside of this range to resolve the issue.
Exploit
Correção
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Debian
Spring Framework