CVE-2023-34042

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-34042
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://spring.io/security/cve-2023-34042 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:5.7.9:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:5.7.10:*:*:*:*:*:*:*
History

12 Feb 2024, 20:45

Type Values Removed Values Added
References () https://spring.io/security/cve-2023-34042 - () https://spring.io/security/cve-2023-34042 - Vendor Advisory
CPE cpe:2.3:a:vmware:spring_security:5.7.10:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:5.7.9:*:*:*:*:*:*:*
Summary
  • (es) El archivo spring-security.xsd dentro del jar spring-security-config se puede escribir en todo el mundo, lo que significa que si se extrajera, cualquier persona con acceso al sistema de archivos podría escribirlo. Si bien no se conocen exploits, este es un ejemplo de "CWE-732: Asignación de permisos incorrecta para recursos críticos" y podría resultar en un exploit. Los usuarios deben actualizar a la última versión de Spring Security para mitigar cualquier vulnerabilidad futura que se encuentre en torno a este problema.
CVSS v2 : unknown
v3 : 4.1 		v2 : unknown
v3 : 5.5
First Time Vmware spring Security
Vmware
CWE CWE-732

05 Feb 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-05 22:15

Updated : 2024-02-12 20:45

NVD link : CVE-2023-34042

Mitre link : CVE-2023-34042

CVE.ORG link : CVE-2023-34042

JSON object : View

Products Affected

vmware

  • spring_security
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource