Skip to content
Fencer Vulns
critical 9.1

CVE-2023-34034 in the critical feed json

Access Control Bypass in Spring Security

published 2023-07-19 3 y ago modified 2026-06-17 4 mo ago also GHSA-3h6f-g5f3-gc4w , EUVD-2023-1939

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.1%
EPSS 4.1% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

Patch / fix

  • maven org.springframework.security:spring-security-config 5.6.12, 5.7.10, 5.8.5, 6.0.5, 6.1.2
  • vmware spring_security 5.6.12, 5.7.10, 5.8.5, 6.0.5, 6.1.2

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-34034 updated cvss 8.1

spring-security-webflux: path wildcard leads to security bypass

  • Red Hat JBoss Fuse 6 spring-security spring-security
    affected: workaround, no fix planned “Users of path-based URL determination should ensure that all their patterns have a slash prepended. example: pathMatchers("home/**") // vulnerable pathMatchers("/home/**") // not vulnerable”
  • Red Hat Process Automation 7 spring-security spring-security
    affected: workaround, no fix available “Users of path-based URL determination should ensure that all their patterns have a slash prepended. example: pathMatchers("home/**") // vulnerable pathMatchers("/home/**") // not vulnerable”
  • Red Hat Fuse 7.12.1
    fixed: vendor fix “Users of path-based URL determination should ensure that all their patterns have a slash prepended. example: pathMatchers("home/**") // vulnerable pathMatchers("/home/**") // not vulnerable” RHSA-2023:7247
  • Red Hat build of Quarkus quarkus-spring-security Red Hat Integration Camel Quarkus 2 spring-security spring-security Red Hat Single Sign-On 7 spring-security spring-security
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
6 mo ago

Exploit prediction

4.07% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.springframework.security:spring-security-config
>=5.6.0, <5.6.12
>=5.7.0, <5.7.10
>=5.8.0, <5.8.5
>=6.0.0, <6.0.5
>=6.1.0, <6.1.2
5.6.12
5.7.10
5.8.5
6.0.5
6.1.2

Affected products

  • n/a Spring Security

Classification

Weakness
  • CWE-281 Improper Preservation of Permissions
  • CWE-284 Improper Access Control
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.