CVE-2023-20863: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

April 13, 2023 (updated February 2, 2024)

In spring framework versions prior to 5.2.24 release+,5.3.27+ and 6.0.8+, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

References

github.com/advisories/GHSA-wxqc-pxw9-g2p8
github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e
nvd.nist.gov/vuln/detail/CVE-2023-20863
spring.io/security/cve-2023-20863

Detect and mitigate CVE-2023-20863 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →