{
  "threat_severity" : "Important",
  "public_date" : "2023-07-19T00:00:00Z",
  "bugzilla" : {
    "description" : "spring-security-webflux: path wildcard leads to security bypass",
    "id" : "2241271",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2241271"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-145",
  "details" : [ "Using \"**\" as a pattern in Spring Security configuration \nfor WebFlux creates a mismatch in pattern matching between Spring \nSecurity and Spring WebFlux, and the potential for a security bypass.", "A flaw was found in Spring Security's WebFlux framework pattern matching, where it does not properly evaluate certain patterns. A server using path-based pattern matching in WebFlux could allow an attacker to bypass security settings for some request paths, potentially leading to information disclosure, access of functionality outside the user's permissions, or denial of service." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Fuse 7.12.1",
    "release_date" : "2023-11-15T00:00:00Z",
    "advisory" : "RHSA-2023:7247",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7",
    "package" : "spring-security"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat build of Quarkus",
    "fix_state" : "Not affected",
    "package_name" : "io.quarkus/quarkus-spring-security",
    "cpe" : "cpe:/a:redhat:quarkus:2",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Integration Camel Quarkus 2",
    "fix_state" : "Not affected",
    "package_name" : "spring-security",
    "cpe" : "cpe:/a:redhat:camel_quarkus:2",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat JBoss Fuse 6",
    "fix_state" : "Out of support scope",
    "package_name" : "spring-security",
    "cpe" : "cpe:/a:redhat:jboss_fuse:6"
  }, {
    "product_name" : "Red Hat Process Automation 7",
    "fix_state" : "Affected",
    "package_name" : "spring-security",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
  }, {
    "product_name" : "Red Hat Single Sign-On 7",
    "fix_state" : "Not affected",
    "package_name" : "spring-security",
    "cpe" : "cpe:/a:redhat:red_hat_single_sign_on:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-34034\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-34034\nhttps://spring.io/security/cve-2023-34034" ],
  "name" : "CVE-2023-34034",
  "mitigation" : {
    "value" : "Users of path-based URL determination should ensure that all their patterns have a slash prepended.\nexample:\npathMatchers(\"home/**\")  // vulnerable\npathMatchers(\"/home/**\")  // not vulnerable",
    "lang" : "en:us"
  },
  "csaw" : false
}