This vulnerability (CWE-288) in Black Duck Coverity Connect version 2023.6.0 involves a flaw in Spring Security that allows an attacker without authentication to bypass authentication and authorization mechanisms. By crafting specific HTTP requests, the attacker can access protected API endpoints and retrieve data without proper credentials. The CVSS 4.0 base score is 9.2, indicating a critical severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

An unauthenticated malicious actor can bypass authentication and authorization controls on certain API endpoints, potentially exposing sensitive data within Coverity Connect. This compromises the confidentiality and integrity of the system's data and could lead to unauthorized data disclosure or manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor Black Duck advisories for updates and apply patches once available. Until then, restrict network access to the affected API endpoints where possible.