Back to search
CVE-2023-20860
Published: Mar 27, 2023
Modified: Feb 19, 2025
PUBLISHED
Description
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
| Vendor | Product | Versions |
|---|---|---|
n/a | Spring Framework | affected Spring Framework (versions 6.0.0 to 6.0.6 and 5.3.0 to 5.3.25) |
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now