Vulnerability · Published Apr 13, 2023 · Assigned by vmware
CVE-2023-20866
Medium 6.5
In plain English
A medium-severity information exposure in Spring Session. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.session:spring-session-core | 3.0.1 | GHSA-r7qr-f43m-pxfr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Spring Session | Spring session versions 3.0.x prior to 3.0.1 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N