CVE-2023-34042

The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.
References
Link Resource
https://spring.io/security/cve-2023-34042 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:5.7.9:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:5.7.10:*:*:*:*:*:*:*

History

12 Feb 2024, 20:45

Type Values Removed Values Added
First Time Vmware
Vmware spring Security
CPE cpe:2.3:a:vmware:spring_security:5.7.10:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:5.7.9:*:*:*:*:*:*:*
References () https://spring.io/security/cve-2023-34042 - () https://spring.io/security/cve-2023-34042 - Vendor Advisory
CWE CWE-732
CVSS v2 : unknown
v3 : 4.1
v2 : unknown
v3 : 5.5
Summary
  • (es) El archivo spring-security.xsd dentro del jar spring-security-config se puede escribir en todo el mundo, lo que significa que si se extrajera, cualquier persona con acceso al sistema de archivos podría escribirlo. Si bien no se conocen exploits, este es un ejemplo de "CWE-732: Asignación de permisos incorrecta para recursos críticos" y podría resultar en un exploit. Los usuarios deben actualizar a la última versión de Spring Security para mitigar cualquier vulnerabilidad futura que se encuentre en torno a este problema.

05 Feb 2024, 22:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-02-05 22:15

Updated : 2024-02-12 20:45


NVD link : CVE-2023-34042

Mitre link : CVE-2023-34042

CVE.ORG link : CVE-2023-34042


JSON object : View

Products Affected

vmware

  • spring_security
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource