Log in Start free

Vulnerability · Published Feb 5, 2024 · Assigned by vmware

CVE-2023-34042

Medium 4.1

In plain English

A medium-severity incorrect permission assignment in Spring Security. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)0.2%top 84.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.springframework.security:spring-security-config6.1.4GHSA-9gp8-6cg8-7h34
Mavenorg.springframework.security:spring-security-config6.0.7GHSA-9gp8-6cg8-7h34
Mavenorg.springframework.security:spring-security-config5.8.7GHSA-9gp8-6cg8-7h34
Mavenorg.springframework.security:spring-security-config5.7.11GHSA-9gp8-6cg8-7h34

Affected products (as reported)

VendorProductVersions
N/A Spring Security Spring Security 6.1.x prior to 6.1.4, Spring Security 6.0.x prior to 6.0.7, Spring Security 5.8.x prior to 5.8.7, Spring Security 5.7.x prior to 5.7.11

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

References