Incorrect permission assignment for critical resource in Spring Security - CVE-2023-34042

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU80886

Incorrect permission assignment for critical resource in Spring Security - CVE-2023-34042

Published: September 19, 2023


Vulnerability identifier: #VU80886
CSH Severity: Low
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-34042
CWE-ID: CWE-732
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to incorrect permission assignment for spring-security.xsd. A local administrator can write arbitrary file on the system.


Affected software

Spring Security
IBM Maximo Application Suite
IBM Process Mining
IBM Spectrum Conductor
IBM Sterling Connect:Direct Web Services
IBM Spectrum Symphony
IBM Security Guardium
IBM Data Risk Manager
Operational Decision Manager

How to mitigate CVE-2023-34042

Install updates from vendor's website.

Spring Security - addressed in versions 5.7.11, 5.8.7, 6.0.7, 6.1.4
IBM Maximo Application Suite - addressed in versions 8.10.6, 8.11.1
IBM Process Mining - update to 1.14.3
IBM Data Risk Manager - update to 2.0.6.20
IBM Spectrum Conductor - update to 2.5.1 Fix 601861
IBM Sterling Connect:Direct Web Services - addressed in versions 6.1.0.24, 6.2.0.23, 6.3.0.7
IBM Spectrum Symphony - update to 7.3.2 Fix 601860
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 47, 8.11.0.1 Interim fix 25, 8.11.1 Interim fix 15, 8.12.0 Interim fix 6

External References

Related Security Bulletins