CVE-2023-20860

At a glance

Severity: HIGH 7.5
EPSS: EPSS 3.51 % · percentile 89 (2026-10-27)
State: PUBLISHED
Published: 2023-03-27
Updated: 2025-02-19
Assigner: vmware
NVD status: Modified

Description

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	CISA-ADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Advisories

GHSA-7phw-cxx7-q9vq — Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

European references

ENISA EUVD · EUVD-2023-0927
GCVE · GCVE-0-2023-20860

CERT-FR advisories

CERTFR-2024-AVI-0010 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2023-AVI-0990 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2023-AVI-0567 — Multiples vulnérabilités dans Oracle WebLogic · cert.ssi.gouv.fr
CERTFR-2023-AVI-0513 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2023-AVI-0398 — Multiples vulnérabilités dans le cadriciel VMware Spring · cert.ssi.gouv.fr
CERTFR-2023-AVI-0397 — Vulnérabilité dans IBM Sterling Connect · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* ≥ 5.3.0 < 5.3.26
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* ≥ 6.0.0 < 6.0.7

Affected products

Product	Versions
Spring Framework	affected Spring Framework (versions 6.0.0 to 6.0.6 and 5.3.0 to 5.3.25)

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD