Spring Security Advisories

All advisories

CVE-2023-20860: Security Bypass With Un-Prefixed Double Wildcard Pattern

HIGH | MARCH 20, 2023 | CVE-2023-20860

Description

Using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

Affected Spring Products and Versions

  • Spring Framework:
    • 6.0.0 to 6.0.6
    • 5.3.0 to 5.3.25
    • Versions older than 5.3 are not affected

Mitigation

The following Spring Framework versions contain fixes for this vulnerability:

  • 6.0.7+
  • 5.3.26+

Credit

This vulnerability was discovered internally.

References

History

  • 2023-03-20: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring Runtime offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all