CVE-2023-34034

State: Published
Severity: 9.1 Critical
Published: Jul 19, 2023
Updated: May 1, 2026
Reserved: May 25, 2023

Description

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	vmware

Weaknesses

CWE-281 Improper Preservation of Permissions

Affected Products

Product	Versions
Spring Securityn/a	Spring Security 6.1.0 through 6.1.1Affected Spring Security 6.0.0 through 6.0.4Affected Spring Security 5.8.0 through 5.8.4Affected Spring Security 5.7.0 through 5.7.9 Affected Spring Security 5.6.0 through 5.6.11Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.