GHSA-7phw-cxx7-q9vq CVE-2023-20860
Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch
- Severity
- 9.1 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 3.51%
- Chance of exploitation in the next 30 days. Higher than 89.21% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- Available
- 2 packages have a fixed version
Description
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.springframework:spring | >= 6.0.0, < 6.0.7 |
6.0.7 |
| org.springframework:spring | >= 5.3.0, < 5.3.26 |
5.3.26 |
| org.springframework:spring-webmvc | >= 6.0.0, < 6.0.7 |
6.0.7 |
| org.springframework:spring-webmvc | >= 5.3.0, < 5.3.26 |
5.3.26 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.springframework:spring Maven → 6.0.7
- maven
<dependency><groupId>org.springframework</groupId><artifactId>spring</artifactId><version>6.0.7</version></dependency>- gradle
implementation("org.springframework:spring:6.0.7")
org.springframework:spring-webmvc Maven → 6.0.7
- maven
<dependency><groupId>org.springframework</groupId><artifactId>spring-webmvc</artifactId><version>6.0.7</version></dependency>- gradle
implementation("org.springframework:spring-webmvc:6.0.7")
Severity breakdown
CVSS 3.1 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework | Critical Known exploited | Also affects org.springframework:spring-webmvc |
| GHSA-j9f9-w8pj-32f8 Spring Framework Server Sent Event stream corruption while rendering fragments | Critical | Also affects org.springframework:spring-webmvc |
| GHSA-pc63-qcmh-9cmg Spring Framework Improper Path Limitation in XsltView | Critical | Also affects org.springframework:spring-webmvc |
| GHSA-cjpg-rgq5-fr37 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux | Medium | Also affects org.springframework:spring-webmvc |
| GHSA-957g-f97v-vppc Spring Framework Cross-site Scripting via JSP Form Tags | Medium | Also affects org.springframework:spring-webmvc |
| GHSA-3chg-m5w7-qfv5 Spring Framework Cross-site Scripting via JavaScriptUtils | Medium | Also affects org.springframework:spring-webmvc |
| GHSA-h3qp-gqrc-q736 Spring Framework Open Redirect in Spring MVC and WebFlux | Medium | Also affects org.springframework:spring-webmvc |
| GHSA-72pg-x5f8-j25j Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux | Medium | Also affects org.springframework:spring-webmvc |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor