5.5

CVE-2023-34042

The spring-security.xsd file inside the 
spring-security-config jar is world writable which means that if it were
 extracted it could be written by anyone with access to the file system.


While there are no known exploits, this is an example of “CWE-732: 
Incorrect Permission Assignment for Critical Resource” and could result 
in an exploit. Users should update to the latest version of Spring 
Security to mitigate any future exploits found around this issue.

Data is provided by the National Vulnerability Database (NVD)
VMware ≫ Spring Security Version >= 5.8.4 < 5.8.7
VMware ≫ Spring Security Version >= 6.0.4 < 6.0.7
VMware ≫ Spring Security Version >= 6.1.1 < 6.1.4
VMware ≫ Spring Security Version5.7.9
VMware ≫ Spring Security Version5.7.10
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.04% 0.119
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
security@vmware.com 4.1 0.5 3.6
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.