Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5d1w-2cga-kua7
Vulnerability ID VCID-5d1w-2cga-kua7
Aliases CVE-2023-34035
GHSA-4vpr-xfrp-cj64
Summary Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. (DispatcherServlet is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.) Specifically, an application is vulnerable when all of the following are true: * Spring MVC is on the classpath * Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet) * The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpoints An application is not vulnerable if any of the following is true: * The application does not have Spring MVC on the classpath * The application secures no servlets other than Spring MVC’s DispatcherServlet * The application uses requestMatchers(String) only for Spring MVC endpoints
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
System Score Found at
epss 0.02632 https://api.first.org/data/v1/epss?cve=CVE-2023-34035
epss 0.02632 https://api.first.org/data/v1/epss?cve=CVE-2023-34035
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-4vpr-xfrp-cj64
cvssv3.1 7.3 https://github.com/spring-projects/spring-security/commit/bb46a5427005e33e637b15948de8adae244ce547
generic_textual HIGH https://github.com/spring-projects/spring-security/commit/bb46a5427005e33e637b15948de8adae244ce547
cvssv3.1 7.3 https://github.com/spring-projects/spring-security/commit/df239b6448ccf138b0c95b5575a88f33ac35cd9a
generic_textual HIGH https://github.com/spring-projects/spring-security/commit/df239b6448ccf138b0c95b5575a88f33ac35cd9a
cvssv3.1 7.3 https://github.com/spring-projects/spring-security-samples/commit/4e3bec904a5467db28ea33e25ac9d90524b53d66
generic_textual HIGH https://github.com/spring-projects/spring-security-samples/commit/4e3bec904a5467db28ea33e25ac9d90524b53d66
cvssv3.1 7.3 https://github.com/spring-projects/spring-security-samples/tree/main/servlet/java-configuration/authentication/preauth
generic_textual HIGH https://github.com/spring-projects/spring-security-samples/tree/main/servlet/java-configuration/authentication/preauth
cvssv3.1 7.3 https://nvd.nist.gov/vuln/detail/CVE-2023-34035
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-34035
cvssv3.1 7.3 https://spring.io/security/cve-2023-34035
generic_textual HIGH https://spring.io/security/cve-2023-34035
ssvc Track https://spring.io/security/cve-2023-34035
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/spring-projects/spring-security/commit/bb46a5427005e33e637b15948de8adae244ce547
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/spring-projects/spring-security/commit/df239b6448ccf138b0c95b5575a88f33ac35cd9a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/spring-projects/spring-security-samples/commit/4e3bec904a5467db28ea33e25ac9d90524b53d66
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/spring-projects/spring-security-samples/tree/main/servlet/java-configuration/authentication/preauth
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2023-34035
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://spring.io/security/cve-2023-34035
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none


Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-25T15:47:27Z/ Found at https://spring.io/security/cve-2023-34035
Exploit Prediction Scoring System (EPSS)
Percentile 0.86025
EPSS Score 0.02632
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:26:07.261336+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/34xxx/CVE-2023-34035.json 38.6.0