CVE-2023-20860 is a high-severity vulnerability affecting the Spring Framework, a popular Java application framework. This security issue occurs when a specific pattern ("**") is used in Spring Security configuration with the mvcRequestMatcher, leading to a mismatch in pattern matching between Spring Security and Spring MVC, and potentially allowing a security bypass. Systems running certain versions of the Spring Framework are affected by this vulnerability.

How do I know if I'm affected?

If you're using the Spring Framework, you might be affected by the vulnerability. This issue impacts systems running specific versions of the framework: 6.0.0 to 6.0.6 and 5.3.0 to 5.3.25. To determine if you're affected, check your Spring Framework version and see if it falls within these ranges. Keep in mind that this vulnerability is related to using a double wildcard pattern ("**") in the Spring Security configuration with the mvcRequestMatcher, which can lead to a security bypass.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to take action. Update your Spring Framework to versions 6.0.7+ or 5.3.26+ to fix the issue. This will help prevent potential security bypasses caused by the double wildcard pattern in the Spring Security configuration with the mvcRequestMatcher.

Is CVE-2023-20860 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-20860 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This security issue, related to the Spring Framework and its security configuration, was published on 03/27/2023. There is no due date provided, but to mitigate the vulnerability, users should update their Spring Framework to versions 6.0.7+ or 5.3.26+.

Weakness enumeration

The CVE-2023-20860 vulnerability is categorized as “NVD-CWE-noinfo” meaning there’s insufficient information on it.

For more details

CVE-2023-20860 is a high-severity vulnerability in the Spring Framework that can lead to unauthorized data disclosure or modification. By analyzing various sources, including the National Vulnerability Database and security advisories from NetApp and Spring, we've provided a comprehensive overview of the issue and its potential impact. For more information about the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or links below.

• NetApp Security Advisory

• Spring Security Advisory