Description

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

Remediation

References

https://spring.io/security/cve-2023-20863

https://security.netapp.com/advisory/ntap-20240524-0015/

Related Vulnerabilities

CVE-2014-0050 Vulnerability in maven package org.apache.tomcat:tomcat-coyote

CVE-2014-0110 Vulnerability in maven package org.apache.cxf:cxf-bundle-minimal

CVE-2023-29020 Vulnerability in npm package @fastify/passport

CVE-2023-48218 Vulnerability in npm package strapi-plugin-protected-populate

CVE-2015-5256 Vulnerability in npm package cordova-android

Severity

High

Classification

CWE-917 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Tags

Vendor Advisory