CVE-2023-34034 @ Maven-org.springframework.security:spring-security-config-5.5.2

[SamHeadrickCx]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2023-34034
Checkmarx Project: SamHeadrickCx/easybuggy4sb
Repository URL: https://github.com/SamHeadrickCx/easybuggy4sb
Branch: master
Scan ID: 94cbf8fd-fbe8-49c7-9c55-da0658f9cbfc

---

In Spring Security configuration using "**" as a pattern for WebFlux, creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass. This vulnerability affects packages org.springframework.security:spring-security-config and org.springframework.security:spring-security-web in versions 5.0.0 through 5.6.11, 5.7.0 through 5.7.9, 5.8.0 through 5.8.4, 6.0.0 through 6.0.4, and 6.1.0 through 6.1.1.

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 5.6.12