Description

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

Remediation

References

https://security.netapp.com/advisory/ntap-20230814-0008/

https://spring.io/security/cve-2023-34034

Related Vulnerabilities

CVE-2022-26850 Vulnerability in maven package org.apache.nifi:nifi-single-user-utils

CVE-2023-35158 Vulnerability in maven package org.xwiki.platform:xwiki-platform-flamingo-skin-resources

CVE-2023-37914 Vulnerability in maven package org.xwiki.platform:xwiki-platform-invitation-ui

CVE-2014-7810 Vulnerability in maven package org.apache.tomcat:jasper

CVE-2023-28708 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory NVD-CWE-noinfo