csaf_certbund - wid-sec-w-2023-2385

WID-SEC-W-2023-2385

Vulnerability from csaf_certbund - Published: 2023-09-18 22:00 - Updated: 2023-12-20 23:00

Summary

VMware Tanzu Spring Security: Schwachstelle ermöglicht Manipulation von Dateien

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Spring Security ist ein Framework, das Authentifizierung, Autorisierung und Schutz vor gängigen Angriffen bietet.

Angriff

Ein lokaler Angreifer kann eine Schwachstelle in VMware Tanzu Spring Security ausnutzen, um Dateien zu manipulieren.

Betroffene Betriebssysteme

- Linux - MacOS X - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "niedrig"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Spring Security ist ein Framework, das Authentifizierung, Autorisierung und Schutz vor g\u00e4ngigen Angriffen bietet.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann eine Schwachstelle in VMware Tanzu Spring Security ausnutzen, um Dateien zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2385 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2385.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2385 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2385"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2023-09-18",
        "url": "https://spring.io/blog/2023/09/18/spring-security-5-8-7-6-0-7-6-1-4-6-2-0-m1-released-including-fixes-for-cve"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2023-09-18",
        "url": "https://spring.io/security/cve-2023-34042"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7076274 vom 2023-11-15",
        "url": "https://www.ibm.com/support/pages/node/7076274"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7100884 vom 2023-12-20",
        "url": "https://www.ibm.com/support/pages/node/7100884"
      }
    ],
    "source_lang": "en-US",
    "title": "VMware Tanzu Spring Security: Schwachstelle erm\u00f6glicht Manipulation von Dateien",
    "tracking": {
      "current_release_date": "2023-12-20T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:58:35.309+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-2385",
      "initial_release_date": "2023-09-18T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-09-18T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-11-15T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-12-20T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM Operational Decision Manager",
            "product": {
              "name": "IBM Operational Decision Manager",
              "product_id": "T005180",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:operational_decision_manager:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "IBM Security Guardium 12.0",
            "product": {
              "name": "IBM Security Guardium 12.0",
              "product_id": "T031092",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:security_guardium:12.0"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "VMware Tanzu Spring Security \u003c 5.8.7",
                "product": {
                  "name": "VMware Tanzu Spring Security \u003c 5.8.7",
                  "product_id": "T029959",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_security:5.8.7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "VMware Tanzu Spring Security \u003c 6.0.7",
                "product": {
                  "name": "VMware Tanzu Spring Security \u003c 6.0.7",
                  "product_id": "T029960",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_security:6.0.7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "VMware Tanzu Spring Security \u003c 6.1.4",
                "product": {
                  "name": "VMware Tanzu Spring Security \u003c 6.1.4",
                  "product_id": "T029961",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_security:6.1.4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "VMware Tanzu Spring Security \u003c 6.2.0-M1",
                "product": {
                  "name": "VMware Tanzu Spring Security \u003c 6.2.0-M1",
                  "product_id": "T029962",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_security:6.2.0-m1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spring Security"
          }
        ],
        "category": "vendor",
        "name": "VMware Tanzu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-34042",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in VMware Tanzu Spring Security. Dieser Fehler besteht im spring-security-config jar, da die Datei spring-security.xsd weltweit schreibbar ist. Ein lokaler Angreifer mit Zugriff auf das Dateisystem kann diese Schwachstelle ausnutzen, um Dateien zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T031092",
          "T005180"
        ]
      },
      "release_date": "2023-09-18T22:00:00.000+00:00",
      "title": "CVE-2023-34042"
    }
  ]
}

CVE-2023-34042 (GCVE-0-2023-34042)

Vulnerability from cvelistv5 – Published: 2024-02-05 22:00 – Updated: 2025-06-03 18:51

Summary

The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.

Severity ?

4.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

CWE

Incorrect Permission Assignment for spring-security.xsd

Assigner

vmware

References

URL

Tags

https://spring.io/security/cve-2023-34042

Impacted products

	Vendor	Product	Version
	N/A	Spring Security	Affected: Spring Security 6.1.x prior to 6.1.4, Spring Security 6.0.x prior to 6.0.7, Spring Security 5.8.x prior to 5.8.7, Spring Security 5.7.x prior to 5.7.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34042",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-06T16:00:46.931733Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-732",
                "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T18:51:02.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-11-29T12:04:39.444Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://spring.io/security/cve-2023-34042"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241129-0010/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Security",
          "vendor": "N/A",
          "versions": [
            {
              "status": "affected",
              "version": "Spring Security 6.1.x prior to 6.1.4, Spring Security 6.0.x prior to 6.0.7, Spring Security 5.8.x prior to 5.8.7, Spring Security 5.7.x prior to 5.7.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\u003cdiv\u003e\u003cp\u003eThe spring-security.xsd file inside the \nspring-security-config jar is world writable which means that if it were\n extracted it could be written by anyone with access to the file system.\u003c/p\u003e\n\u003cp\u003eWhile there are no known exploits, this is an example of \u201cCWE-732: \nIncorrect Permission Assignment for Critical Resource\u201d and could result \nin an exploit. Users should update to the latest version of Spring \nSecurity to mitigate any future exploits found around this issue.\u003c/p\u003e\u003c/div\u003e\n\n"
            }
          ],
          "value": "The spring-security.xsd file inside the \nspring-security-config jar is world writable which means that if it were\n extracted it could be written by anyone with access to the file system.\n\n\nWhile there are no known exploits, this is an example of \u201cCWE-732: \nIncorrect Permission Assignment for Critical Resource\u201d and could result \nin an exploit. Users should update to the latest version of Spring \nSecurity to mitigate any future exploits found around this issue.\n\n\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Incorrect Permission Assignment for spring-security.xsd",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-05T22:00:01.075Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2023-34042"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-34042",
    "datePublished": "2024-02-05T22:00:01.075Z",
    "dateReserved": "2023-05-25T17:21:56.202Z",
    "dateUpdated": "2025-06-03T18:51:02.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2023-2385

CVE-2023-34042 (GCVE-0-2023-34042)

Tags

Sightings

Nomenclature