CVE-2023-34062

    Dashboard / Vulnerabilities / CVE-2023-34062

    CVE-2023-34062

    Published: 15 Nov 2023Last Modified: 28 Oct 2026

    Summary:

    Details: In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.

    References: https://spring.io/security/cve-2023-34062, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34062.json, https://nvd.nist.gov/vuln/detail/CVE-2023-34062

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- bcced1084b7e3e1b509cb0661a35f2c735086287
    Fixed -ea31f0b8affd3db9d9bb66c979d157ac4a51e7b8

    Affected versions

    v1.1.12
    v1.1.11
    v1.1.10
    v1.1.9
    v1.1.8
    v1.1.7
    v1.1.6
    v1.1.5
    v1.1.4
    v1.1.3
    v1.1.2
    v1.1.1
    v1.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-34062 | CVE-DB