CVE-2023-34042: vmware spring security

csirt@kutim:~/threat-intel/cve/CVE-2023-34042

CVSS 5.5 · Medium EPSS 0,24%

Kerentanan Incorrect Permission Assignment for Critical Resource pada vmware spring security. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.

Rincian

Terbit di NVD: 5 Februari 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-732: Incorrect Permission Assignment for Critical Resource
EPSS (30 hari): 0,24% peluang dieksploitasi; lebih tinggi dari 13,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
vmware	spring security	Versi 5.8.4 hingga sebelum 5.8.7
vmware	spring security	Versi 6.0.4 hingga sebelum 6.0.7
vmware	spring security	Versi 6.1.1 hingga sebelum 6.1.4
vmware	spring security	Versi 5.7.9
vmware	spring security	Versi 5.7.10

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://spring.io/security/cve-2023-34042 advisory vendor
https://security.netapp.com/advisory/ntap-20241129-0010/

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.