CVE-2023-20863
published 2023-04-13CVE-2023-20863: In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may…
PriorityP430medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
1.12%
62.6th percentile
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libspring-java | — | — |
| vmware | spring_framework | — | — |
| vmware | spring_framework | >= 5.2.0 < 5.2.24 | 5.2.24 |
| vmware | spring_framework | >= 5.3.0 < 5.3.27 | 5.3.27 |
| vmware | spring_framework | >= 6.0.0 < 6.0.8 | 6.0.8 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5LOW
vendor_oracle6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (Spring Framework) — CVE-2023-20863
vendor_oracle·2024-10-15·CVSS 6.5
CVE-2023-20863 [MEDIUM] Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (Spring Framework) — CVE-2023-20863
Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (Spring Framework) vulnerability
CVE: CVE-2023-20863
CVSS: 6.5
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Oracle
Oracle Oracle Commerce Risk Matrix: Platform (Spring Framework) — CVE-2023-20863
vendor_oracle·2024-04-15·CVSS 6.5
CVE-2023-20863 [MEDIUM] Oracle Oracle Commerce Risk Matrix: Platform (Spring Framework) — CVE-2023-20863
Oracle Oracle Commerce Risk Matrix: Platform (Spring Framework) vulnerability
CVE: CVE-2023-20863
CVSS: 6.5
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
Oracle
Oracle Oracle Commerce Risk Matrix: Workbench, Endeca Application Controller, Content Acquisition System (Spring Framework) — CVE-2023-20863
vendor_oracle·2023-10-15·CVSS 6.5
CVE-2023-20863 [MEDIUM] Oracle Oracle Commerce Risk Matrix: Workbench, Endeca Application Controller, Content Acquisition System (Spring Framework) — CVE-2023-20863
Oracle Oracle Commerce Risk Matrix: Workbench, Endeca Application Controller, Content Acquisition System (Spring Framework) vulnerability
CVE: CVE-2023-20863
CVSS: 6.5
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Charging Server (Spring Framework) — CVE-2023-20863
vendor_oracle·2023-07-15·CVSS 6.5
CVE-2023-20863 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: Charging Server (Spring Framework) — CVE-2023-20863
Oracle Oracle Communications Applications Risk Matrix: Charging Server (Spring Framework) vulnerability
CVE: CVE-2023-20863
CVSS: 6.5
Protocol: TCP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Red Hat
springframework: Spring Expression DoS Vulnerability
vendor_redhat·2023-04-13·CVSS 6.5
CVE-2023-20863 [MEDIUM] CWE-400 springframework: Spring Expression DoS Vulnerability
springframework: Spring Expression DoS Vulnerability
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
A flaw was found in Spring Framework. Certain versions of Spring Framework's Expression Language were not restricting the size of Spring Expressions. This could allow an attacker to craft a malicious Spring Expression to cause a denial of service on the server.
Package: springframework (Red Hat Fuse 7) - Affected
Debian
CVE-2023-20863: libspring-java - In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it i...
vendor_debian·2023·CVSS 6.5
CVE-2023-20863 [MEDIUM] CVE-2023-20863: libspring-java - In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it i...
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
OSV
CVE-2023-20863: In spring framework versions prior to 5
osv·2023-04-13·CVSS 6.5
CVE-2023-20863 [MEDIUM] CVE-2023-20863: In spring framework versions prior to 5
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
GHSA
Spring Framework vulnerable to denial of service
ghsa·2023-04-13
CVE-2023-20863 [HIGH] CWE-400 Spring Framework vulnerable to denial of service
Spring Framework vulnerable to denial of service
In Spring Framework versions prior to 5.2.24.release+ , 5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial-of-service (DoS) condition.
OSV
Spring Framework vulnerable to denial of service
osv·2023-04-13
CVE-2023-20863 [HIGH] Spring Framework vulnerable to denial of service
Spring Framework vulnerable to denial of service
In Spring Framework versions prior to 5.2.24.release+ , 5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial-of-service (DoS) condition.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-04-13
Published