Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-bc13-cmhx-dbcj
Vulnerability ID VCID-bc13-cmhx-dbcj
Aliases CVE-2023-34042
GHSA-9gp8-6cg8-7h34
Summary The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-732 Incorrect Permission Assignment for Critical Resource
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-34042.json
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2023-34042
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2023-34042
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2023-34042
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-9gp8-6cg8-7h34
cvssv3.1 5.5 https://github.com/spring-projects/spring-security
generic_textual MODERATE https://github.com/spring-projects/spring-security
cvssv3.1 5.5 https://github.com/spring-projects/spring-security/commit/5b293d21161e946bf241d9e974b9af93cfafaaac
generic_textual MODERATE https://github.com/spring-projects/spring-security/commit/5b293d21161e946bf241d9e974b9af93cfafaaac
cvssv3.1 5.5 https://nvd.nist.gov/vuln/detail/CVE-2023-34042
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2023-34042
cvssv3.1 5.5 https://security.netapp.com/advisory/ntap-20241129-0010
generic_textual MODERATE https://security.netapp.com/advisory/ntap-20241129-0010
cvssv3.1 4.1 https://spring.io/security/cve-2023-34042
cvssv3.1 5.5 https://spring.io/security/cve-2023-34042
generic_textual MODERATE https://spring.io/security/cve-2023-34042
ssvc Track https://spring.io/security/cve-2023-34042
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-34042.json
https://api.first.org/data/v1/epss?cve=CVE-2023-34042
https://github.com/spring-projects/spring-security
https://github.com/spring-projects/spring-security/commit/5b293d21161e946bf241d9e974b9af93cfafaaac
https://security.netapp.com/advisory/ntap-20241129-0010
2262911 https://bugzilla.redhat.com/show_bug.cgi?id=2262911
cve-2023-34042 https://spring.io/security/cve-2023-34042
CVE-2023-34042 https://nvd.nist.gov/vuln/detail/CVE-2023-34042
GHSA-9gp8-6cg8-7h34 https://github.com/advisories/GHSA-9gp8-6cg8-7h34
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-34042.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/spring-projects/spring-security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/spring-projects/spring-security/commit/5b293d21161e946bf241d9e974b9af93cfafaaac
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-34042
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://security.netapp.com/advisory/ntap-20241129-0010
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N Found at https://spring.io/security/cve-2023-34042
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://spring.io/security/cve-2023-34042
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-06T16:00:46Z/ Found at https://spring.io/security/cve-2023-34042
Exploit Prediction Scoring System (EPSS)
Percentile 0.13523
EPSS Score 0.00043
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:26:00.796201+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/34xxx/CVE-2023-34042.json 38.6.0