CVE-2023-20862
Description
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
How to fix
- vmware spring_security5.7.8, 5.8.3, 6.0.3 or later
- org.springframework.security:spring-security-core5.7.8, 5.8.3, 6.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware spring_security | 5.7.0 ≤ v < 5.7.8, 5.8.0 ≤ v < 5.8.3, 6.0.0 ≤ v < 6.0.3 | 5.7.8, 5.8.3, 6.0.3 |
| netapp active_iq_unified_manager | No range specified | — |
| org.springframework.security:spring-security-coreMaven | 5.7.0 ≤ v < 5.7.8, 5.8.0 ≤ v < 5.8.3, 6.0.0 ≤ v < 6.0.3 | 5.7.8, 5.8.3, 6.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.