PT-2023-17684 · Unknown · Spring Boot

Published 2023-04-20 · Updated 2023-08-28 · CVE-2023-20873

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Boot versions 3.0.0 through 3.0.5 Spring Boot versions 2.7.0 through 2.7.10 Spring Boot older unsupported versions

Description An application that is deployed to Cloud Foundry could be susceptible to a security bypass.

Recommendations For Spring Boot versions 3.0.0 through 3.0.5, upgrade to 3.0.6 or later. For Spring Boot versions 2.7.0 through 2.7.10, upgrade to 2.7.11 or later. For Spring Boot older unsupported versions, upgrade to 3.0.6 or later, or 2.7.11 or later.

Fix

Related Identifiers

CVE-2023-20873

GHSA-G5H3-W546-PJ7F

Affected Products

Spring Boot

References · 19

• https://spring.io/security/cve-2023-20873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20873 · Security Note
• https://osv.dev/vulnerability/GHSA-g5h3-w546-pj7f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-20873 · Vendor Advisory
• https://github.com/spring-projects/spring-boot · Note
• https://github.com/spring-projects/spring-boot/releases/tag/v2.6.15 · Note
• https://github.com/spring-projects/spring-boot/commit/3522714c13b47af03bf42e7f2d5994af568cb1a7 · Note
• https://github.com/spring-projects/spring-boot/releases/tag/v3.0.6 · Note
• https://github.com/spring-projects/spring-boot/releases/tag/v2.5.15 · Note
• https://github.com/spring-projects/spring-boot/releases/tag/v2.7.11 · Note
• https://github.com/spring-projects/spring-boot/commit/32444fed4b51cc58dc908467f706102d7f0bfc15 · Note
• https://t.me/cvenotify/51560 · Telegram Post
• https://t.me/cvenotify/48772 · Telegram Post
• https://t.me/cvenotify/49541 · Telegram Post
• https://security.netapp.com/advisory/ntap-20230601-0009 · Note