PT-2023-3578 · Spring · Spring Webflux

Ha1C9On + 1 · Published 2023-07-17 · Updated 2024-10-28 · CVE-2023-34034

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Spring WebFlux versions (affected versions not specified)

Description Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass. The issue may allow a remote attacker to bypass existing security restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Improper Preservation of Permissions

Improper Access Control

Improper Authorization

Weakness Enumeration

CWE-287

CWE-254

CWE-281

CWE-284

CWE-285

Related Identifiers

BDU:2023-03799

BDU:2023-03800

CVE-2023-34034

GHSA-3H6F-G5F3-GC4W

Affected Products

Spring Webflux

References · 32

• https://spring.io/security/cve-2023-34034 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03800 · Security Note
• https://bdu.fstec.ru/vul/2023-03799 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34034 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34034 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3h6f-g5f3-gc4w · Vendor Advisory
• https://twitter.com/_r_netsec/status/1688946442759708672 · Twitter Post
• https://t.me/cvenotify/99740 · Telegram Post
• https://twitter.com/JFrogSecurity/status/1688940012295913472 · Twitter Post
• https://t.me/cvenotify/54645 · Telegram Post
• https://t.me/thebugbountyhunter/7629 · Telegram Post
• https://security.netapp.com/advisory/ntap-20230814-0008 · Note
• https://twitter.com/luiscosio/status/1688947096634728448 · Twitter Post
• https://twitter.com/privetpostrujus/status/1688991353319944194 · Twitter Post
• https://t.me/cibsecurity/67011 · Telegram Post