GHSA-3h6f-g5f3-gc4w

ghsaUSosv

Access Control Bypass in Spring Security

view advisory published 2023-07-19Licence: CC-BY-4.0

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-34034US	critical9.8	4.11% (91st)	Exploit	2023-07-19
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a se…

references

External citations — patches, advisories, analysis.

https://nvd.nist.gov/vuln/detail/CVE-2023-34034ADVISORY
https://ossindex.sonatype.org/vulnerability/CVE-2023-34034WEB
https://security.netapp.com/advisory/ntap-20230814-0008WEB
https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-5777893WEB
https://spring.io/security/cve-2023-34034WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan