5

CVE-2023-34050










In spring AMQP versions 1.0.0 to
2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class
names were added to Spring AMQP, allowing users to lock down deserialization of
data in messages from untrusted sources; however by default, when no allowed
list was provided, all classes could be deserialized.



Specifically, an application is
vulnerable if




   *  the
     SimpleMessageConverter or SerializerMessageConverter is used

   *  the user
     does not configure allowed list patterns

   *  untrusted
     message originators gain permissions to write messages to the RabbitMQ
     broker to send malicious content

Data is provided by the National Vulnerability Database (NVD)
VMware ≫ Spring Advanced Message Queuing Protocol Version >= 1.0.0 < 2.4.16
VMware ≫ Spring Advanced Message Queuing Protocol Version >= 3.0.0 < 3.0.9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 41.07% 0.973
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
security@vmware.com 5 0.7 4.2
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://spring.io/security/cve-2023-34050
Vendor Advisory
Mitigation