CVE-2023-20863
13.04.2023, 20:15
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
| Vendor | Product | Version |
|---|---|---|
| vmware | spring_framework | 5.2.0 ≤ 𝑥 < 5.2.24 |
| vmware | spring_framework | 5.3.0 ≤ 𝑥 < 5.3.27 |
| vmware | spring_framework | 6.0.0 ≤ 𝑥 < 6.0.8 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
- CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')The software constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.