CVE-2023-20860: Security Bypass With Un-Prefixed Double Wildcard Pattern

HIGH | MARCH 20, 2023 | CVE-2023-20860

Description

Using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

Affected Spring Products and Versions

Spring Framework:
- 6.0.0 to 6.0.6
- 5.3.0 to 5.3.25
- Versions older than 5.3 are not affected

Mitigation

The following Spring Framework versions contain fixes for this vulnerability:

6.0.7+
5.3.26+

Credit

This vulnerability was discovered internally.

History

2023-03-20: Initial vulnerability report published.

Reporting a vulnerability

The VMware Security Response team provides a single point of contact for the reporting of security vulnerabilities in VMware Tanzu products and coordinates the process of investigating any reported vulnerabilities.

To report a security vulnerability in a VMware service or product please refer to the VMware Security Response Policy.