CVE-2023-34034 — n/a / Spring Security

Description (CNA)

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

Affected (CNA)

Vendor / product	Versions
n/a / Spring Security	affected Spring Security 6.1.0 through 6.1.1; affected Spring Security 6.0.0 through 6.0.4; affected Spring Security 5.8.0 through 5.8.4; affected Spring Security 5.7.0 through 5.7.9; affected Spring Security 5.6.0 through 5.6.11

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2023-34034
https://security.netapp.com/advisory/ntap-20230814-0008/

ADP enrichment

CVE

No English description supplied.

https://spring.io/security/cve-2023-34034
https://security.netapp.com/advisory/ntap-20230814-0008/

CISA-ADP

No English description supplied.

No references supplied.