CVEvulnerability

CVE-2023-34036

5.3 MEDIUM Published 2023-07-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-07-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-116, CWE-644

Description

Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server. For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.

Affected configurations

• vmware spring hateoas (< 1.5.5) • vmware spring hateoas (>= 2.0.0 < 2.0.5) • vmware spring hateoas 2.1.0

Related

Weakness · CWE (2)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax weakness

References