PT-2023-17679 · Spring · Spring Vault

Martin Kiesel · Publicado 2023-03-23 · Atualizado 2023-03-28 · CVE-2023-20859

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring Vault versions 2.3.x prior to 2.3.3 Spring Vault versions 3.0.x prior to 3.0.2

Description The application is vulnerable to the insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.

Recommendations For versions 2.3.x prior to 2.3.3, update to version 2.3.3 or later. For versions 3.0.x prior to 3.0.2, update to version 3.0.2 or later. As a temporary workaround, consider restricting access to the log files to minimize the risk of sensitive information exposure.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2023-20859

GHSA-R47R-87P9-8JH3

Produtos afetados

Spring Vault

Referências · 7

• https://github.com/spring-projects/spring-vault · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-20859 · Nota de Segurança
• https://t.me/cvenotify/46999 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-r47r-87p9-8jh3 · Aviso do Fabricante
• https://t.me/cibsecurity/60630 · Publicação no Telegram
• https://spring.io/security/cve-2023-20859 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-20859 · Aviso do Fabricante