search

finos / symphony-bdk-java

The Symphony BDK (Bot Developer Kit) for Java helps you to create production-grade Chat Bots and Extension Applications on top of the Symphony REST APIs.
https://symphony-bdk-java.finos.org
Apache License 2.0
23 stars 68 forks source link

CVE-2023-20860 (High) detected in spring-webmvc-5.3.25.jar - autoclosed #752

Closed mend-for-github-com[bot] closed 1 year ago

mend-for-github-com[bot] commented 1 year ago

CVE-2023-20860 - High Severity Vulnerability

Vulnerable Library - spring-webmvc-5.3.25.jar

Spring Web MVC

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /symphony-bdk-examples/bdk-spring-boot-example/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-webmvc/5.3.25/62a8258bcc4f7a58dd69af5140481b64653c90/spring-webmvc-5.3.25.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-webmvc/5.3.25/62a8258bcc4f7a58dd69af5140481b64653c90/spring-webmvc-5.3.25.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-webmvc/5.3.25/62a8258bcc4f7a58dd69af5140481b64653c90/spring-webmvc-5.3.25.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-webmvc/5.3.25/62a8258bcc4f7a58dd69af5140481b64653c90/spring-webmvc-5.3.25.jar

Dependency Hierarchy: - symphony-bdk-app-spring-boot-starter-2.12.0-SNAPSHOT (Root Library) - spring-boot-starter-web-2.7.9.jar - :x: **spring-webmvc-5.3.25.jar** (Vulnerable Library)

Found in HEAD commit: 0c8fd1d2cd61e6f822378d79406b3c6c6db83073

Found in base branch: main

Vulnerability Details

Security Bypass With Un-Prefixed Double Wildcard Pattern was discovered in spring framework from 5.3.x to 5.3.25 and 6.0.0 to 6.0.6. Using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass. Versions 5.3.26 and 6.0.7 contain a patch. Versions older than 5.3 are not affected.

Publish Date: 2022-11-02

URL: CVE-2023-20860

CVSS 3 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/blog/2023/03/21/this-week-in-spring-march-21st-2023/

Release Date: 2022-11-02

Fix Resolution: org.springframework:spring-webmvc:5.3.26,6.0.7

mend-for-github-com[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.