PT-2023-24650 · Spring · Spring Hateoas

Hans Hosea Schaefer · Publicado 2023-07-17 · Atualizado 2023-07-17 · CVE-2023-34036

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spring HATEOAS (affected versions not specified)

Description Reactive web applications using Spring HATEOAS to produce hypermedia-based responses may be exposed to malicious forwarded headers if not behind a trusted proxy or without measures to handle such headers in WebFlux or the underlying HTTP server. The application is affected if it uses the reactive web stack with Spring HATEOAS and does not guard against clients submitting (X-)Forwarded headers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-644

CWE-116

Identificadores relacionados

CVE-2023-34036

GHSA-7M5C-FGWF-MWPH

Produtos afetados

Spring Hateoas

Referências · 7

• https://github.com/spring-projects/spring-hateoas · Nota
• https://osv.dev/vulnerability/CVE-2023-34036 · Aviso do Fabricante
• https://t.me/cvenotify/54475 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-7m5c-fgwf-mwph · Aviso do Fabricante
• https://spring.io/security/cve-2023-34036 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-34036 · Nota de Segurança
• https://t.me/cibsecurity/66807 · Publicação no Telegram