Skip to content
OpenAdvisories

Package · Maven

org.springframework.security:spring-security-config

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2023-34034 Public exploit

    Access Control Bypass in Spring Security

    Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

    org.springframework.security:spring-security-config Maven
  • High 7.3
    CVE-2023-34035 Public exploit

    Spring Security's authorization rules can be misconfigured when using multiple servlets

    Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s Dispatche…

    org.springframework.security:spring-security-config Maven