CVE-2023-20866
Medium
Description
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Vmware Spring Session
PublishedApr 13, 2023
First seenApr 13, 2023
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- org.springframework.session:spring-session-core3.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware spring_session | 3.0.0 | — |
| org.springframework.session:spring-session-coreMaven | 3.0.0 ≤ v < 3.0.1 | 3.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.