CVE-2023-34034
At a glance Severity CRITICAL 9.1 EPSS EPSS 4.11 % · percentile 91 (2026-10-28) State PUBLISHED Published 2023-07-19 Updated 2026-05-01 Assigner vmware NVD status Modified Description Using "**" as a pattern in Spring Security configuration
for WebFlux creates a mismatch in pattern matching between Spring
Security and Spring WebFlux, and the potential for a security bypass.
Scores Version Score Vector Scored by CVSS 3.1 CRITICAL 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N vmware CVSS 3.1 CRITICAL 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N NVD · security@vmware.com (Secondary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
Advisories
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* ≥ 5.6.0 < 5.6.12cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* ≥ 5.7.0 < 5.7.10cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* ≥ 5.8.0 < 5.8.5cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* ≥ 6.0.0 < 6.0.5cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* ≥ 6.1.0 < 6.1.2Affected products Product Versions Spring Security affected Spring Security 6.1.0 ≤ 6.1.1 ; affected Spring Security 6.0.0 ≤ 6.0.4 ; affected Spring Security 5.8.0 ≤ 5.8.4 ; affected Spring Security 5.7.0 ≤ 5.7.9 ; affected Spring Security 5.6.0 ≤ 5.6.11
References
Sources
