// For flags

CVE-2023-34055

Spring Boot server Web Observations DoS Vulnerability

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

* the application uses Spring MVC or Spring WebFlux
* org.springframework.boot:spring-boot-actuator is on the classpath

En las versiones 2.7.0 - 2.7.17, 3.0.0-3.0.12 y 3.1.0-3.1.5 de Spring Boot, es posible que un usuario proporcione solicitudes HTTP especialmente manipuladas que pueden provocar una condición de denegación de servicio ( DoS). Específicamente, una aplicación es vulnerable cuando se cumple todo lo siguiente: * la aplicación usa Spring MVC o Spring WebFlux * org.springframework.boot:spring-boot-actuator está en el classpath

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

* the application uses Spring MVC or Spring WebFlux
* org.springframework.boot:spring-boot-actuator is on the classpath



*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-05-25 CVE Reserved
  • 2023-11-28 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-10-28 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-400: Uncontrolled Resource Consumption
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Vmware
Search vendor "Vmware"
 Spring Boot
Search vendor "Vmware" for product "Spring Boot"
 >= 2.7.0 <= 2.7.17
Search vendor "Vmware" for product "Spring Boot" and version " >= 2.7.0 <= 2.7.17"
-
Affected
Vmware
Search vendor "Vmware"
 Spring Boot
Search vendor "Vmware" for product "Spring Boot"
 >= 3.0.0 <= 3.0.12
Search vendor "Vmware" for product "Spring Boot" and version " >= 3.0.0 <= 3.0.12"
-
Affected
Vmware
Search vendor "Vmware"
 Spring Boot
Search vendor "Vmware" for product "Spring Boot"
 >= 3.1.0 <= 3.1.5
Search vendor "Vmware" for product "Spring Boot" and version " >= 3.1.0 <= 3.1.5"
-
Affected