ghsa-9gp8-6cg8-7h34
Vulnerability from github
Published
2024-02-06 00:30
Modified
2024-11-29 12:31
Severity ?
Summary
Spring Security's spring-security.xsd file is world writable
Details
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system.
While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.1.3"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-config"
},
"ranges": [
{
"events": [
{
"introduced": "6.1.1"
},
{
"fixed": "6.1.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.0.6"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-config"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.4"
},
{
"fixed": "6.0.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.8.6"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-config"
},
"ranges": [
{
"events": [
{
"introduced": "5.8.4"
},
{
"fixed": "5.8.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.7.10"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-config"
},
"ranges": [
{
"events": [
{
"introduced": "5.7.9"
},
{
"fixed": "5.7.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-34042"
],
"database_specific": {
"cwe_ids": [
"CWE-732"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-06T15:52:33Z",
"nvd_published_at": "2024-02-05T22:15:55Z",
"severity": "MODERATE"
},
"details": "The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system.\n\nWhile there are no known exploits, this is an example of \u201cCWE-732: Incorrect Permission Assignment for Critical Resource\u201d and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.",
"id": "GHSA-9gp8-6cg8-7h34",
"modified": "2024-11-29T12:31:48Z",
"published": "2024-02-06T00:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34042"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-security/commit/5b293d21161e946bf241d9e974b9af93cfafaaac"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-security"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241129-0010"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2023-34042"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Spring Security\u0027s spring-security.xsd file is world writable"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.