CVE-2023-20873 is a critical security vulnerability affecting applications deployed to Cloud Foundry using certain versions of Spring Boot. With a severity score of 9.8, this security bypass issue can have significant consequences for affected systems. The vulnerability is present in Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions. Users of affected versions should upgrade to mitigate the risk.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, check if your application is using Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, or older unsupported versions, and is deployed to Cloud Foundry. Your application is vulnerable if it can handle requests that match /cloudfoundryapplication/, typically through a catch-all request mapping which matches /. If your application is not deployed to Cloud Foundry, has disabled Cloud Foundry actuator endpoints with management.cloudfoundry.enabled set to false, or doesn't have handler mappings for /cloudfoundryapplication/**, it is not vulnerable.

What should I do if I'm affected?

If you're affected by the vulnerability, follow these simple steps: first, identify the Spring Boot version your application is using. If it's within the affected range, upgrade to a fixed version like 3.0.6+ or 2.7.11+. This will help secure your application and prevent potential security bypass issues.

Is CVE-2023-20873 in CISA’s Known Exploited Vulnerabilities Catalog?

As of now, CVE-2023-20873 is not listed in CISA's Known Exploited Vulnerabilities Catalog. This security vulnerability, related to certain versions of Spring Boot deployed to Cloud Foundry, has a severity score of 9.8. To address this issue, users of affected versions should upgrade to 3.0.6+ or 2.7.11+ to prevent potential security bypass problems.

Weakness enumeration

The Weakness Enumeration for CVE-2023-20873 is identified as NVD-CWE-noinfo (Insufficient Information). This vulnerability affects multiple products, including NetApp and Spring Boot, and can lead to sensitive information disclosure, data modification, or Denial of Service.

For more details

CVE-2023-20873 is a critical security vulnerability affecting certain Spring Boot versions deployed to Cloud Foundry. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• NetApp Security Advisory

• Spring Security Advisory

• Spring Boot 2.5.15 and 2.6.15 Release Announcement