PT-2023-17684 · Unknown · Spring Boot

CVE-2023-20873 · Published 2023-04-20 · Updated 2023-08-28

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Boot versions 3.0.0 through 3.0.5 Spring Boot versions 2.7.0 through 2.7.10 Spring Boot older unsupported versions

Description An application that is deployed to Cloud Foundry could be susceptible to a security bypass.

Recommendations For Spring Boot versions 3.0.0 through 3.0.5, upgrade to 3.0.6 or later. For Spring Boot versions 2.7.0 through 2.7.10, upgrade to 2.7.11 or later. For Spring Boot older unsupported versions, upgrade to 3.0.6 or later, or 2.7.11 or later.

Exploit

Fix

Related Identifiers

CVE-2023-20873

GHSA-G5H3-W546-PJ7F

Affected Products

Spring Boot

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/20xxx/CVE-2023-20873.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-20873 · Security Note
• https://spring.io/security/cve-2023-20873 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-20873 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g5h3-w546-pj7f · Vendor Advisory
• https://github.com/spring-projects/spring-boot · Note
• https://github.com/spring-projects/spring-boot/commit/3522714c13b47af03bf42e7f2d5994af568cb1a7 · Note
• https://github.com/spring-projects/spring-boot/releases/tag/v2.7.11 · Note
• https://github.com/spring-projects/spring-boot/commit/32444fed4b51cc58dc908467f706102d7f0bfc15 · Note
• https://github.com/spring-projects/spring-boot/releases/tag/v2.5.15 · Note
• https://github.com/spring-projects/spring-boot/releases/tag/v3.0.6 · Note
• https://github.com/spring-projects/spring-boot/releases/tag/v2.6.15 · Note
• https://t.me/pentestingnews/36096 · Telegram Post
• https://t.me/cibsecurity/62553 · Telegram Post
• https://security.netapp.com/advisory/ntap-20230601-0009 · Note