CVE-2023-20866
CVSS V2 None
CVSS V3 None
Description
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
Overview
- CVE ID
- CVE-2023-20866
- Assigner
- security@vmware.com
- Vulnerability Status
- Analyzed
- Published Version
- 2023-04-13T20:15:08
- Last Modified Date
- 2023-04-21T18:51:45
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:vmware:spring_session:3.0.0:*:*:*:*:*:*:* | 1 | OR |
References
| Reference URL | Reference Tags |
|---|---|
| https://spring.io/security/cve-2023-20866 |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-20866 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20866 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2023-04-17 04:41:31 | Added to TrackCVE | |||
| 2023-04-17 04:41:33 | Weakness Enumeration | new | ||
| 2023-04-19 11:00:36 | Awaiting Analysis | Undergoing Analysis | Vulnerability Status | updated |
| 2023-04-21 19:00:57 | 2023-04-21T18:51:45 | CVE Modified Date | updated | |
| 2023-04-21 19:00:57 | Undergoing Analysis | Analyzed | Vulnerability Status | updated |
| 2023-04-21 19:01:01 | Weakness Enumeration | update | ||
| 2023-04-21 19:01:02 | CPE Information | updated |