Authentication Bypass in Dromara SaToken by Spring Dynamic Controllers
CVE-2023-43961

8.8HIGH

Key Information:

Vendor

Dromara

Status
Sa-token
Vendor
CVE Published:
25 October 2023

What is CVE-2023-43961?

The vulnerability in Dromara SaToken versions 1.3.50RC and earlier involves an authentication bypass caused by specially crafted requests when utilizing Spring dynamic controllers. This flaw could allow attackers to bypass authentication mechanisms, posing a risk to the integrity of affected systems. It is crucial for users to review their implementations and apply necessary updates to mitigate this issue.

References

https://github.com/dromara/Sa-Token/issues/511

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.