CVE-2023-20862
Spring Security
MEDIUM 6.3
En bref
- Source
- NVD
- EPSS
- EPSS 0.65 % · centile 51 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- vmware
- Statut NVD
- Modified
Description
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
Faiblesses (CWE)
- CWE-459 — Nettoyage incomplet
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | CISA-ADP |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Avis
- GHSA-x873-6rgc-94jc — Spring Security logout not clearing security context
Références européennes
- ENISA EUVD · EUVD-2023-1423
- GCVE · GCVE-0-2023-20862
Avis du CERT-FR
- CERTFR-2024-AVI-0010 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0908 — Multiples vulnérabilités dans les produits NetApp · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0563 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0398 — Multiples vulnérabilités dans le cadriciel VMware Spring · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*≥ 5.7.0 < 5.7.8cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*≥ 5.8.0 < 5.8.3cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.0.3cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Spring Security | affected Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |