Vulnerability in Vmware Spring Security
CVE-2023-34042
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.
EPSS: 0.002 (12.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Vmware Spring_security — versions 5.7.9, 5.7.10
- N/a Spring Security — versions Spring Security 6.1.x prior to 6.1.4, Spring Security 6.0.x prior to 6.0.7, Spring Security 5.8.x prior to 5.8.7, Spring Security 5.7.x prior to 5.7.11
Weakness classification (CWE)
References
- security@vmware.com (Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2023-34042?
- CVE-2023-34042 is a medium-severity vulnerability in Vmware Spring Security, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 4.1/10. Published 2024-02-05.
- How severe is CVE-2023-34042?
- Medium severity. CVSS v3 base score is 4.1 out of 10.