GHSA-7phw-cxx7-q9vq

Suggest an improvement
Source
https://github.com/advisories/GHSA-7phw-cxx7-q9vq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-7phw-cxx7-q9vq/GHSA-7phw-cxx7-q9vq.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-7phw-cxx7-q9vq
Aliases
Published
2023-03-28T00:34:28Z
Modified
2024-12-03T05:48:02.413758Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch
Details

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

Database specific
{
    "nvd_published_at": "2023-03-27T22:15:00Z",
    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-28T13:39:35Z"
}
References

Affected packages

Maven / org.springframework:spring

Package

Name
org.springframework:spring
View open source insights on deps.dev
Purl
pkg:maven/org.springframework/spring

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.7

Maven / org.springframework:spring

Package

Name
org.springframework:spring
View open source insights on deps.dev
Purl
pkg:maven/org.springframework/spring

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.3.0
Fixed
5.3.26

Affected versions

5.*

5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25