{"id":"GHSA-wxqc-pxw9-g2p8","summary":"Spring Framework vulnerable to denial of service","details":"In Spring Framework versions prior to 5.2.24.release+ , 5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial-of-service (DoS) condition.","aliases":["CVE-2023-20863"],"modified":"2024-06-10T18:50:23.552189Z","published":"2023-04-13T21:30:27Z","database_specific":{"cwe_ids":["CWE-400","CWE-770","CWE-917"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-04-17T17:19:53Z","nvd_published_at":"2023-04-13T20:15:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20863"},{"type":"WEB","url":"https://github.com/spring-projects/spring-framework/commit/965a6392757d20f9db19241126fcc719a51eac15"},{"type":"WEB","url":"https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e"},{"type":"WEB","url":"https://github.com/spring-projects/spring-framework/commit/ebc82654282bda547fbc20a9749ab1bda886a46f"},{"type":"PACKAGE","url":"https://github.com/spring-projects/spring-framework"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240524-0015"},{"type":"WEB","url":"https://spring.io/security/cve-2023-20863"}],"affected":[{"package":{"name":"org.springframework:spring-expression","ecosystem":"Maven","purl":"pkg:maven/org.springframework/spring-expression"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.8"}]}],"versions":["6.0.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-wxqc-pxw9-g2p8/GHSA-wxqc-pxw9-g2p8.json"}},{"package":{"name":"org.springframework:spring-expression","ecosystem":"Maven","purl":"pkg:maven/org.springframework/spring-expression"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.27"}]}],"versions":["5.3.0","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.14","5.3.15","5.3.16","5.3.17","5.3.18","5.3.19","5.3.2","5.3.20","5.3.21","5.3.22","5.3.23","5.3.24","5.3.25","5.3.26","5.3.3","5.3.4","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-wxqc-pxw9-g2p8/GHSA-wxqc-pxw9-g2p8.json"}},{"package":{"name":"org.springframework:spring-expression","ecosystem":"Maven","purl":"pkg:maven/org.springframework/spring-expression"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.24.RELEASE"}]}],"versions":["3.0.0.RELEASE","3.0.1.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE","3.2.0.RELEASE","3.2.1.RELEASE","3.2.10.RELEASE","3.2.11.RELEASE","3.2.12.RELEASE","3.2.13.RELEASE","3.2.14.RELEASE","3.2.15.RELEASE","3.2.16.RELEASE","3.2.17.RELEASE","3.2.18.RELEASE","3.2.2.RELEASE","3.2.3.RELEASE","3.2.4.RELEASE","3.2.5.RELEASE","3.2.6.RELEASE","3.2.7.RELEASE","3.2.8.RELEASE","3.2.9.RELEASE","4.0.0.RELEASE","4.0.1.RELEASE","4.0.2.RELEASE","4.0.3.RELEASE","4.0.4.RELEASE","4.0.5.RELEASE","4.0.6.RELEASE","4.0.7.RELEASE","4.0.8.RELEASE","4.0.9.RELEASE","4.1.0.RELEASE","4.1.1.RELEASE","4.1.2.RELEASE","4.1.3.RELEASE","4.1.4.RELEASE","4.1.5.RELEASE","4.1.6.RELEASE","4.1.7.RELEASE","4.1.8.RELEASE","4.1.9.RELEASE","4.2.0.RELEASE","4.2.1.RELEASE","4.2.2.RELEASE","4.2.3.RELEASE","4.2.4.RELEASE","4.2.5.RELEASE","4.2.6.RELEASE","4.2.7.RELEASE","4.2.8.RELEASE","4.2.9.RELEASE","4.3.0.RELEASE","4.3.1.RELEASE","4.3.10.RELEASE","4.3.11.RELEASE","4.3.12.RELEASE","4.3.13.RELEASE","4.3.14.RELEASE","4.3.15.RELEASE","4.3.16.RELEASE","4.3.17.RELEASE","4.3.18.RELEASE","4.3.19.RELEASE","4.3.2.RELEASE","4.3.20.RELEASE","4.3.21.RELEASE","4.3.22.RELEASE","4.3.23.RELEASE","4.3.24.RELEASE","4.3.25.RELEASE","4.3.26.RELEASE","4.3.27.RELEASE","4.3.28.RELEASE","4.3.29.RELEASE","4.3.3.RELEASE","4.3.30.RELEASE","4.3.4.RELEASE","4.3.5.RELEASE","4.3.6.RELEASE","4.3.7.RELEASE","4.3.8.RELEASE","4.3.9.RELEASE","5.0.0.RELEASE","5.0.1.RELEASE","5.0.10.RELEASE","5.0.11.RELEASE","5.0.12.RELEASE","5.0.13.RELEASE","5.0.14.RELEASE","5.0.15.RELEASE","5.0.16.RELEASE","5.0.17.RELEASE","5.0.18.RELEASE","5.0.19.RELEASE","5.0.2.RELEASE","5.0.20.RELEASE","5.0.3.RELEASE","5.0.4.RELEASE","5.0.5.RELEASE","5.0.6.RELEASE","5.0.7.RELEASE","5.0.8.RELEASE","5.0.9.RELEASE","5.1.0.RELEASE","5.1.1.RELEASE","5.1.10.RELEASE","5.1.11.RELEASE","5.1.12.RELEASE","5.1.13.RELEASE","5.1.14.RELEASE","5.1.15.RELEASE","5.1.16.RELEASE","5.1.17.RELEASE","5.1.18.RELEASE","5.1.19.RELEASE","5.1.2.RELEASE","5.1.20.RELEASE","5.1.3.RELEASE","5.1.4.RELEASE","5.1.5.RELEASE","5.1.6.RELEASE","5.1.7.RELEASE","5.1.8.RELEASE","5.1.9.RELEASE","5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.15.RELEASE","5.2.16.RELEASE","5.2.17.RELEASE","5.2.18.RELEASE","5.2.19.RELEASE","5.2.2.RELEASE","5.2.20.RELEASE","5.2.21.RELEASE","5.2.22.RELEASE","5.2.23.RELEASE","5.2.3.RELEASE","5.2.4.RELEASE","5.2.5.RELEASE","5.2.6.RELEASE","5.2.7.RELEASE","5.2.8.RELEASE","5.2.9.RELEASE"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-wxqc-pxw9-g2p8/GHSA-wxqc-pxw9-g2p8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}