Lucene search
F5F5:K000134500HistoryMay 08, 2023 - 12:00 a.m.
K000134500 : Spring Framework vulnerability CVE-2023-20860
2023-05-0800:00:00
my.f5.com
14
spring framework
security advisory
pattern matching
spring security
spring mvc
vulnerability
cve-2023-20860
Security Advisory Description
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using “**” as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass (CVE-2023-20860).
Impact
There is no impact; F5 products are not affected by this vulnerability.
Related
ibm
ibm
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security bypass in VMware Tanzu Spring Framework [CVE-2023-20860]
2023-06-28 19:44:02
nvd
nvd
CVE-2023-20860
2023-03-27 22:15:21
veracode
veracode
Security Bypass
2023-03-30 02:11:25
ubuntucve
ubuntucve
CVE-2023-20860
2023-03-27 00:00:00
osv
osv
CVE-2023-20860
2023-03-27 22:15:21
debiancve
debiancve
CVE-2023-20860
2023-03-27 22:15:21
prion
prion
Security feature bypass
2023-03-27 22:15:00
githubexploit
githubexploit
Exploit for CVE-2023-20860
2023-03-24 07:23:52
cvelist
cvelist
CVE-2023-20860
2023-03-27 00:00:00
github
github
nessus
nessus
RHEL 8 : Red Hat Virtualization (RHSA-2023:3771)
2023-06-22 00:00:00
Oracle Identity Manager (Jul 2023 CPU)
2023-07-21 00:00:00
atlassian
atlassian
Upgrade spring-core for CVE-2023-20860
2023-05-17 06:46:56
cve
cve
CVE-2023-20860
2023-03-27 22:15:21
openvas
openvas
spring
spring
This Week in Spring - March 21st, 2023
2023-03-21 00:00:00
redhatcve
redhatcve
CVE-2023-20861
2023-03-24 13:07:29
CVE-2023-20860
2023-03-24 13:07:33
redhat
redhat
oracle
oracle
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00