CVE-2023-20860

CVE Database · CVE-2023-20860

CVE-2023-20860

· HIGHModified

CVSS v3.1

7.5

EPSS

3.51%

Published

Mar 27, 2023

Modified

Feb 19, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products (2)

vmware · spring_framework (up to 5.3.26)vulnerable

vmware · spring_framework (up to 6.0.7)vulnerable

References (4)

https://security.netapp.com/advisory/ntap-20230505-0006/

https://spring.io/security/cve-2023-20860

Vendor Advisory

https://security.netapp.com/advisory/ntap-20230505-0006/

https://spring.io/security/cve-2023-20860

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs