VYPR
← All advisories
Medium severity4.1NVD Advisory· Published Feb 5, 2024· Updated Jun 17, 2026

CVE-2023-34042

CVE-2023-34042

Description

The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system.

While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.springframework.security:spring-security-configMaven
>= 6.1.1, < 6.1.46.1.4
org.springframework.security:spring-security-configMaven
>= 6.0.4, < 6.0.76.0.7
org.springframework.security:spring-security-configMaven
>= 5.8.4, < 5.8.75.8.7
org.springframework.security:spring-security-configMaven
>= 5.7.9, < 5.7.115.7.11

Affected products

5
  • VMware/Spring Security4 versions
    cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*range: >=5.8.4,<5.8.7
    • cpe:2.3:a:vmware:spring_security:5.7.10:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:spring_security:5.7.9:*:*:*:*:*:*:*
    • (no CPE)range: Spring Security 6.1.x prior to 6.1.4, Spring Security 6.0.x prior to 6.0.7, Spring Security 5.8.x prior to 5.8.7, Spring Security 5.7.x prior to 5.7.11
  • ghsa-coords
    pkg:maven/org.springframework.security/spring-security-config
    Range: >= 6.1.1, < 6.1.4

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.