PT-2023-17681 · Unknown · Spring Session

Benedikt Halser · Publicado 2023-04-13 · Atualizado 2023-04-21 · CVE-2023-20866

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring Session version 3.0.0

Description The session id can be logged to the standard output stream, exposing sensitive information to those who have access to the application logs. This can be used for session hijacking, specifically in applications using HeaderHttpSessionIdResolver.

Recommendations For Spring Session version 3.0.0, consider disabling the HeaderHttpSessionIdResolver to minimize the risk of exploitation until a patch is available. Restrict access to application logs to prevent unauthorized access to sensitive session information.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2023-20866

GHSA-R7QR-F43M-PXFR

Produtos afetados

Spring Session

Referências · 9

• https://github.com/spring-projects/spring-session · Nota
• https://github.com/spring-projects/spring-session/commit/c98a7be0e2ced7f795018f05397dca4bd5ca8212 · Nota
• https://github.com/spring-projects/spring-session/issues/2215 · Nota
• https://osv.dev/vulnerability/CVE-2023-20866 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-r7qr-f43m-pxfr · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-20866 · Nota de Segurança
• https://spring.io/security/cve-2023-20866 · Aviso do Fabricante
• https://t.me/cvenotify/48856 · Publicação no Telegram
• https://t.me/cibsecurity/62083 · Publicação no Telegram