Medium severity5.0NVD Advisory· Published Oct 19, 2023· Updated Jun 17, 2026
CVE-2023-34050
CVE-2023-34050
Description
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized.
Specifically, an application is vulnerable if
* the SimpleMessageConverter or SerializerMessageConverter is used
* the user does not configure allowed list patterns
* untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*Range: >=1.0.0,<2.4.16
1.0.0 to 2.4.16, 3.0.0 to 3.0.9+ 1 more
- (no CPE)range: 1.0.0 to 2.4.16, 3.0.0 to 3.0.9
- (no CPE)range: 1.0.0
Patches
Vulnerability mechanics
References
1- spring.io/security/cve-2023-34050nvdMitigationVendor Advisory
News mentions
0No linked articles in our index yet.