HIGH | JULY 17, 2023 | CVE-2023-34035
Description Severity is high unless otherwise noted. Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5 and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) or…
MEDIUM | JULY 14, 2023 | CVE-2023-34036
Description Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything…
HIGH | MAY 19, 2023 | CVE-2023-20883
Description In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache. Specifically…
HIGH | APRIL 20, 2023 | CVE-2023-20873
Description In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Specifically, an application is…
HIGH | APRIL 17, 2023 | CVE-2023-20862
Description In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to…
HIGH | APRIL 13, 2023 | CVE-2023-20863
Description In Spring Framework versions 6.0.0 - 6.0.7, 5.3.0 - 5.3.26, 5.2.0.RELEASE - 5.2.23.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition…
MEDIUM | APRIL 12, 2023 | CVE-2023-20866
Description In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an…
MEDIUM | MARCH 20, 2023 | CVE-2023-20859
Description The authentication mechanism creates Batch tokens. Usage of LifecycleAwareSessionManager in an imperative-only arrangement. LifecycleAwareSessionManager.destroy() is called by the application or the application shutdown hook The logging level for…
MEDIUM | MARCH 20, 2023 | CVE-2023-20861
Description In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition…
HIGH | MARCH 20, 2023 | CVE-2023-20860
Description Using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass. Affected Spring Products and Versions Spring…
