CVE-2023-20883
published 2023-05-26CVE-2023-20883: In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.90%
55.6th percentile
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | spring_boot | < 2.5.14 | 2.5.14 |
| vmware | spring_boot | — | — |
| vmware | spring_boot | 2.6.0 – 2.6.14 | — |
| vmware | spring_boot | 2.7.0 – 2.7.11 | — |
| vmware | spring_boot | 3.0.0 – 3.0.6 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Spring Boot) — CVE-2023-20883
vendor_oracle·2024-01-15·CVSS 7.5
CVE-2023-20883 [HIGH] Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Spring Boot) — CVE-2023-20883
Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Spring Boot) vulnerability
CVE: CVE-2023-20883
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Oracle
Oracle Oracle Communications Risk Matrix: Install/Upgrade (Spring Boot) — CVE-2023-20883
vendor_oracle·2023-10-15·CVSS 7.5
CVE-2023-20883 [HIGH] Oracle Oracle Communications Risk Matrix: Install/Upgrade (Spring Boot) — CVE-2023-20883
Oracle Oracle Communications Risk Matrix: Install/Upgrade (Spring Boot) vulnerability
CVE: CVE-2023-20883
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Red Hat
spring-boot: Spring Boot Welcome Page DoS Vulnerability
vendor_redhat·2023-05-18·CVSS 7.5
CVE-2023-20883 [HIGH] CWE-400 spring-boot: Spring Boot Welcome Page DoS Vulnerability
spring-boot: Spring Boot Welcome Page DoS Vulnerability
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
A flaw was found in Spring Boot, occurring prominently in Spring MVC with a reverse proxy cache. This issue requires Spring MVC to have auto-configuration enabled and the application to use Spring Boot's welcome page support, either static or templated, resulting in the application being deployed behind a proxy that caches 404 responses. This issue may cause a denial of service (DoS) attack.
Package: spring-boot (A-MQ Clients 2) - Not affected
Package: spring-boot (Migration Toolkit for Runtimes) - Aff
GHSA
Spring Boot Welcome Page Denial of Service
ghsa·2023-05-26
CVE-2023-20883 [HIGH] CWE-400 Spring Boot Welcome Page Denial of Service
Spring Boot Welcome Page Denial of Service
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
Specifically, an application is vulnerable if all of the conditions are true:
* The application has Spring MVC auto-configuration enabled. This is the case by default if Spring MVC is on the classpath.
* The application makes use of Spring Boot's welcome page support, either static or templated.
* Your application is deployed behind a proxy which caches 404 responses.
Your application is NOT vulnerable if any of the following are true:
* Spring MVC auto-configuration is disabled. This is true if WebMvcAutoConfigur
OSV
Spring Boot Welcome Page Denial of Service
osv·2023-05-26
CVE-2023-20883 [HIGH] Spring Boot Welcome Page Denial of Service
Spring Boot Welcome Page Denial of Service
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
Specifically, an application is vulnerable if all of the conditions are true:
* The application has Spring MVC auto-configuration enabled. This is the case by default if Spring MVC is on the classpath.
* The application makes use of Spring Boot's welcome page support, either static or templated.
* Your application is deployed behind a proxy which caches 404 responses.
Your application is NOT vulnerable if any of the following are true:
* Spring MVC auto-configuration is disabled. This is true if WebMvcAutoConfigur
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-05-26
Published