CVE-2023-38493

Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or `JettyService` with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of the matrix variables. If an attacker sends a specially crafted request, the request may bypass the authorizer. Version 1.24.3 contains a patch for this issue.

• CWE-863

• https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-methods/matrix-variables.htmlProduct
• https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07Patch
• https://github.com/line/armeria/security/advisories/GHSA-wvp2-9ppw-337jVendor Advisory
• https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-methods/matrix-variables.htmlProduct
• https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07Patch
• https://github.com/line/armeria/security/advisories/GHSA-wvp2-9ppw-337jVendor Advisory

Published

Jul 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38488Kirby is a content management system. A vulnerability in ver…8.8
• CVE-2023-38489Kirby is a content management system. A vulnerability in ver…7.3
• CVE-2023-3849A vulnerability, which was classified as problematic, was fo…6.1
• CVE-2023-38490Kirby is a content management system. A vulnerability in ver…10
• CVE-2023-38491Kirby is a content management system. A vulnerability in ver…5.4
• CVE-2023-38492Kirby is a content management system. A vulnerability in ver…7.5
• CVE-2023-38494MeterSphere is an open-source continuous testing platform. P…7.5
• CVE-2023-38495Crossplane is a framework for building cloud native control …9.8
• CVE-2023-38496Apptainer is an open source container platform. Version 1.2.…3.3
• CVE-2023-38497Cargo downloads the Rust project’s dependencies and compiles…7.3
• CVE-2023-38498Discourse is an open source discussion platform. Prior to ve…6.5
• CVE-2023-38499TYPO3 is an open source PHP based web content management sys…5.3