Strix
26.1K

CVE-2023-34042

MEDIUMCVSS 5.5/10EPSS 0.22%

Last modified

CVE-2023-34042 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue. . EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Description

The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.

Metrics

CVSS 3.1
5.5/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS Probability
0.22%

11.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
VmwareSpring Security>= 5.8.4, < 5.8.7
VmwareSpring Security>= 6.0.4, < 6.0.7
VmwareSpring Security>= 6.1.1, < 6.1.4
VmwareSpring Security5.7.9
VmwareSpring Security5.7.10

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-34042?
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.
How severe is CVE-2023-34042?
CVE-2023-34042 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.
How do I fix CVE-2023-34042?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-34042?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST