Incorrect authorization in Spring Security - CVE-2023-34035

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU82227

Incorrect authorization in Spring Security - CVE-2023-34035

Published: October 18, 2023


Vulnerability identifier: #VU82227
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-34035
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass authorization process.

The vulnerability exists due to authorization rule misconfiguration if the application uses requestMatchers(String) or requestMatchers(HttpMethod, String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. A remote attacker can bypass authorization rules and gain unauthorized access to the application.


Affected software

Spring Security
Cloudera Data Platform Private Cloud Base for IBM
IBM Automation Decision Services
IBM Cloud Pak for Business Automation
ObjectScale
Dell Data Protection Central

How to mitigate CVE-2023-34035

Install updates from vendor's website.

Spring Security - addressed in versions 5.8.5, 6.0.5, 6.1.2
Cloudera Data Platform Private Cloud Base for IBM - update to 7.1.9.3 HF2
IBM Automation Decision Services - update to 23.0.1 IF005
ObjectScale - update to 1.4.0
Dell Data Protection Central - update to 19.10.0-4
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.27, 23.0.1.5

External References

Related Security Bulletins