GHSA-9gp8-6cg8-7h34

    Dashboard / Vulnerabilities / GHSA-9gp8-6cg8-7h34

    GHSA-9gp8-6cg8-7h34

    Published: 6 Feb 2024Last Modified: 29 Nov 2024

    Summary: Spring Security's spring-security.xsd file is world writable

    Details: The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.

    References: https://nvd.nist.gov/vuln/detail/CVE-2023-34042, https://github.com/spring-projects/spring-security/commit/5b293d21161e946bf241d9e974b9af93cfafaaac, https://github.com/spring-projects/spring-security, https://security.netapp.com/advisory/ntap-20241129-0010, https://spring.io/security/cve-2023-34042

    Affected packages

    Package

    Name: org.springframework.security:spring-security-config

    Purl: pkg:maven/org.springframework.security/spring-security-config

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 6.1.1
    Fixed -6.1.4

    Affected versions

    6.1.1
    6.1.2
    6.1.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-9gp8-6cg8-7h34 | CVE-DB