GitHub Advisory DatabaseGHSA-G5H3-W546-PJ7FSpring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.007 Low
EPSS
Percentile
80.7%
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
Affected configurations
References
github.com/advisories/GHSA-g5h3-w546-pj7f
github.com/spring-projects/spring-boot/commit/32444fed4b51cc58dc908467f706102d7f0bfc15
github.com/spring-projects/spring-boot/commit/3522714c13b47af03bf42e7f2d5994af568cb1a7
github.com/spring-projects/spring-boot/releases/tag/v2.5.15
github.com/spring-projects/spring-boot/releases/tag/v2.6.15
github.com/spring-projects/spring-boot/releases/tag/v2.7.11
github.com/spring-projects/spring-boot/releases/tag/v3.0.6
nvd.nist.gov/vuln/detail/CVE-2023-20873
security.netapp.com/advisory/ntap-20230601-0009
spring.io/blog/2023/05/18/spring-boot-2-5-15-and-2-6-15-available-now
spring.io/security/cve-2023-20873
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.007 Low
EPSS
Percentile
80.7%