VMware Spring Boot 2.6.0 +
Approved changes feed: RSS · Atom
cpe:2.3:a:vmware:spring_boot:2.6.0:\+:*:*:*:*:*:*part: a version: 2.6.0 update: +
| Vendor | Vmware (7bb62c7c-2241-5a0b-8dbc-5f13251fb24e) |
|---|---|
| Product | Spring Boot (ce8a169d-e9a4-51b1-8925-509a2f1b1dcc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/spring-projects/spring-boot |
purl2cpe | 2026-10-12 21:11:52.299302 |
pkg:maven/org.springframework.boot/spring-boot |
purl2cpe | 2026-10-12 21:11:52.299303 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-22602 |
vulnerable | 2026-06-08 05:54:26.559893 |
Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request
When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass.
The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching.
Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`
Published: 2023-01-14T09:33:39.775Z
Updated: 2024-08-02T10:13:49.411Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.