CVE-2023-34042

    Dashboard / Vulnerabilities / CVE-2023-34042

    CVE-2023-34042

    Published: 5 Feb 2024Last Modified: 28 Oct 2026

    Summary:

    Details: The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.

    References: https://spring.io/security/cve-2023-34042, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34042.json, https://nvd.nist.gov/vuln/detail/CVE-2023-34042, https://security.netapp.com/advisory/ntap-20241129-0010/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 108075763b506ca0de05d6295e7ad6f5e5f2a601
    Fixed -564a022ab6ad180daab86a68fcfa0a972ae132ef

    Affected versions

    5.7.10
    5.7.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-34042 | CVE-DB