{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-34034", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2023-05-25T17:21:56.199Z", "datePublished": "2023-07-19T14:16:12.150Z", "dateUpdated": "2024-08-02T15:54:14.118Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Spring Security", "vendor": "n/a", "versions": [{"lessThanOrEqual": "6.1.1", "status": "affected", "version": "Spring Security 6.1.0", "versionType": " "}, {"lessThanOrEqual": "6.0.4", "status": "affected", "version": "Spring Security 6.0.0 ", "versionType": " "}, {"lessThanOrEqual": "5.8.4", "status": "affected", "version": "Spring Security 5.8.0", "versionType": " "}, {"lessThanOrEqual": "5.7.9 ", "status": "affected", "version": "Spring Security 5.7.0 ", "versionType": " "}, {"lessThanOrEqual": "5.6.11", "status": "affected", "version": "Spring Security 5.6.0", "versionType": " "}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nUsing <code>\"**\"</code> as a pattern in Spring Security configuration \nfor WebFlux creates a mismatch in pattern matching between Spring \nSecurity and Spring WebFlux, and the potential for a security bypass.\n\n"}], "value": "Using \"**\" as a pattern in Spring Security configuration \nfor WebFlux creates a mismatch in pattern matching between Spring \nSecurity and Spring WebFlux, and the potential for a security bypass.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "potential for a security bypass", "lang": "en"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2023-07-19T14:16:12.150Z"}, "references": [{"url": "https://spring.io/security/cve-2023-34034"}, {"url": "https://security.netapp.com/advisory/ntap-20230814-0008/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:54:14.118Z"}, "title": "CVE Program Container", "references": [{"url": "https://spring.io/security/cve-2023-34034", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20230814-0008/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "3733907C-9C06-4C09-B1DA-084EEB1A74CD", "versionEndExcluding": "5.6.12", "versionStartIncluding": "5.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "6517F944-32C8-4C0A-A0C6-A101C1C9580A", "versionEndExcluding": "5.7.10", "versionStartIncluding": "5.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "C459A8B6-D5BD-4504-90DF-B539AFD4027E", "versionEndExcluding": "5.8.5", "versionStartIncluding": "5.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "9FC21F29-5A00-49C9-BDBD-F488E6E35AE3", "versionEndExcluding": "6.0.5", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "75F8781A-895F-4602-BA07-32BF2DF04CC9", "versionEndExcluding": "6.1.2", "versionStartIncluding": "6.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Using \"**\" as a pattern in Spring Security configuration \nfor WebFlux creates a mismatch in pattern matching between Spring \nSecurity and Spring WebFlux, and the potential for a security bypass.\n\n"}], "id": "CVE-2023-34034", "lastModified": "2023-08-14T19:15:11.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security@vmware.com", "type": "Secondary"}]}, "published": "2023-07-19T15:15:11.127", "references": [{"source": "security@vmware.com", "url": "https://security.netapp.com/advisory/ntap-20230814-0008/"}, {"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2023-34034"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:7247", "cpe": "cpe:/a:redhat:jboss_fuse:7", "package": "spring-security", "product_name": "Red Hat Fuse 7.12.1", "release_date": "2023-11-15T00:00:00Z"}], "bugzilla": {"description": "spring-security-webflux: path wildcard leads to security bypass", "id": "2241271", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241271"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-145", "details": ["Using \"**\" as a pattern in Spring Security configuration \nfor WebFlux creates a mismatch in pattern matching between Spring \nSecurity and Spring WebFlux, and the potential for a security bypass.", "A flaw was found in Spring Security's WebFlux framework pattern matching, where it does not properly evaluate certain patterns. A server using path-based pattern matching in WebFlux could allow an attacker to bypass security settings for some request paths, potentially leading to information disclosure, access of functionality outside the user's permissions, or denial of service."], "mitigation": {"lang": "en:us", "value": "Users of path-based URL determination should ensure that all their patterns have a slash prepended.\nexample:\npathMatchers(\"home/**\") // vulnerable\npathMatchers(\"/home/**\") // not vulnerable"}, "name": "CVE-2023-34034", "package_state": [{"cpe": "cpe:/a:redhat:quarkus:2", "fix_state": "Not affected", "impact": "low", "package_name": "io.quarkus/quarkus-spring-security", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:camel_quarkus:2", "fix_state": "Not affected", "impact": "low", "package_name": "spring-security", "product_name": "Red Hat Integration Camel Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_fuse:6", "fix_state": "Out of support scope", "package_name": "spring-security", "product_name": "Red Hat JBoss Fuse 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Affected", "package_name": "spring-security", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "spring-security", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2023-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-34034\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-34034\nhttps://spring.io/security/cve-2023-34034"], "threat_severity": "Important", "upstream_fix": "spring-security 5.6.12, spring-security 5.7.10, spring-security 5.8.5, spring-security 6.0.5, spring-security 6.1.2"}