Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-34034

33
FAUCET Score

CVE-2023-34034 is a critical security bypass vulnerability affecting VMware Spring Security when used with Spring WebFlux. It arises from a pattern matching mismatch when "**" is used in Spring Security configurations, potentially allowing unauthorized access. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. While not currently listed in CISA KEV or having public exploit code like Metasploit, it has garnered significant community attention, including a detailed write-up and proof-of-concept, and media coverage, indicating a high potential for future exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
>= 5.6.0, < 5.6.12CPE matchmatch criteria
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
>= 5.7.0, < 5.7.10CPE matchmatch criteria
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
>= 5.8.0, < 5.8.5CPE matchmatch criteria
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
>= 6.0.0, < 6.0.5CPE matchmatch criteria
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
>= 6.1.0, < 6.1.2CPE matchmatch criteria
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.1CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
5.2
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.98%
Probability of exploitation in next 30 days
EPSS Percentile
89.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0398 is in the 82nd percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (7)

mavenpatch availablevia ghsa
Product: org.springframework.security:spring-security-configFixed in: 5.6.12
mavenpatch availablevia ghsa
Product: org.springframework.security:spring-security-configFixed in: 5.7.10
mavenpatch availablevia ghsa
Product: org.springframework.security:spring-security-configFixed in: 5.8.5
mavenpatch availablevia ghsa
Product: org.springframework.security:spring-security-configFixed in: 6.0.5
mavenpatch availablevia ghsa
Product: org.springframework.security:spring-security-configFixed in: 6.1.2
redhatpatch availablevia redhat_api
Product: Red Hat Fuse 7.12.1Fixed in: spring-security
View patch
redhatno patchvia redhat_api
Product: Red Hat Process Automation 7Fixed in: spring-security

Vendor Advisories (2)

mavenGHSA-3h6f-g5f3-gc4wcritical

Access Control Bypass in Spring Security

Jul 19, 2023
redhatCVE-2023-34034Important

spring-security-webflux: path wildcard leads to security bypass

Jul 19, 2023

References

security.netapp.com / advisory/ntap-20230814-0008
spring.io / security/cve-2023-34034
Vendor Advisory