Vulnerability · Published Mar 27, 2023 · Assigned by vmware
CVE-2023-20860
High 7.5
In plain English
A high-severity security flaw in Spring Framework. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.5%top 10.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libspring-java | no fix listed | DEBIAN-CVE-2023-20860 |
| Debian:13 | libspring-java | no fix listed | DEBIAN-CVE-2023-20860 |
| Debian:14 | libspring-java | no fix listed | DEBIAN-CVE-2023-20860 |
| Maven | org.springframework:spring | 6.0.7 | GHSA-7phw-cxx7-q9vq |
| Maven | org.springframework:spring | 5.3.26 | GHSA-7phw-cxx7-q9vq |
| Maven | org.springframework:spring-webmvc | 5.3.26 | GHSA-7phw-cxx7-q9vq |
| Maven | org.springframework:spring-webmvc | 6.0.7 | GHSA-7phw-cxx7-q9vq |
| Ubuntu:25.10 | libspring-java | no fix listed | UBUNTU-CVE-2023-20860 |
| Ubuntu:26.04:LTS | libspring-java | no fix listed | UBUNTU-CVE-2023-20860 |
| Ubuntu:26.10 | libspring-java | no fix listed | UBUNTU-CVE-2023-20860 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Spring Framework | Spring Framework (versions 6.0.0 to 6.0.6 and 5.3.0 to 5.3.25) |