CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2023-34034

CVSS 9.1v3.1pub. 2023-07-19upd. 2024-11-21

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • VMware Spring Security

    APP
    Vmware
    5.6.0 – 5.6.12 (excl.)5.7.0 – 5.7.10 (excl.)5.8.0 – 5.8.5 (excl.)6.0.0 – 6.0.5 (excl.)6.1.0 – 6.1.2 (excl.)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2026-59354CRITICAL9.6same product

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client R...

CVE-2026-59270CRITICAL9.4same product

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrat...

CVE-2026-22732CRITICAL9.1PL ✓same product

VMware Spring Security — brak zapisu nagłówków HTTP odpowiedzi

CVE-2022-31692CRITICAL9.8PL ✓same product

Spring Security: pominięcie reguł autoryzacji przez forward/include dispatcher

CVE-2022-22978CRITICAL9.8PL ✓same product

Obejście autoryzacji w Spring Security przez RegexRequestMatcher