CVE-2023-20860 — n/a / Spring Framework

Description (CNA)

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

Affected (CNA)

Vendor / product	Versions
n/a / Spring Framework	affected Spring Framework (versions 6.0.0 to 6.0.6 and 5.3.0 to 5.3.25)

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2023-20860
https://security.netapp.com/advisory/ntap-20230505-0006/

ADP enrichment

CVE

No English description supplied.

https://spring.io/security/cve-2023-20860
https://security.netapp.com/advisory/ntap-20230505-0006/

CISA-ADP

No English description supplied.

No references supplied.