PT-2023-3578 · Spring · Spring Webflux

Ha1C9On + 1 · Publicado 2023-07-17 · Atualizado 2024-10-28 · CVE-2023-34034

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Spring WebFlux versions (affected versions not specified)

Description Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass. The issue may allow a remote attacker to bypass existing security restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Improper Preservation of Permissions

Improper Access Control

Improper Authorization

Enumeração de Fraquezas

CWE-287

CWE-254

CWE-281

CWE-284

CWE-285

Identificadores relacionados

BDU:2023-03799

BDU:2023-03800

CVE-2023-34034

GHSA-3H6F-G5F3-GC4W

Produtos afetados

Spring Webflux

Referências · 32

• https://spring.io/security/cve-2023-34034 · Aviso do Fabricante
• https://twitter.com/_r_netsec/status/1688946442759708672 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-03800 · Nota de Segurança
• https://t.me/cvenotify/99740 · Publicação no Telegram
• https://twitter.com/JFrogSecurity/status/1688940012295913472 · Publicação no Twitter
• https://t.me/cvenotify/54645 · Publicação no Telegram
• https://t.me/thebugbountyhunter/7629 · Publicação no Telegram
• https://security.netapp.com/advisory/ntap-20230814-0008 · Nota
• https://twitter.com/luiscosio/status/1688947096634728448 · Publicação no Twitter
• https://twitter.com/privetpostrujus/status/1688991353319944194 · Publicação no Twitter
• https://t.me/cibsecurity/67011 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-03799 · Nota de Segurança
• https://t.me/proxy_bar/1662 · Publicação no Telegram
• https://twitter.com/0xdea/status/1689180727223390208 · Publicação no Twitter
• https://securityonline.info/spring-security-fixes-two-high-severity-flaws-cve-2023-34034-cve-2023-34035 · Nota