PT-2023-17679 · Spring · Spring Vault

Martin Kiesel · Published 2023-03-23 · Updated 2023-03-28 · CVE-2023-20859

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring Vault versions 2.3.x prior to 2.3.3 Spring Vault versions 3.0.x prior to 3.0.2

Description The application is vulnerable to the insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.

Recommendations For versions 2.3.x prior to 2.3.3, update to version 2.3.3 or later. For versions 3.0.x prior to 3.0.2, update to version 3.0.2 or later. As a temporary workaround, consider restricting access to the log files to minimize the risk of sensitive information exposure.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2023-20859

GHSA-R47R-87P9-8JH3

Affected Products

Spring Vault

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-20859 · Security Note
• https://osv.dev/vulnerability/GHSA-r47r-87p9-8jh3 · Vendor Advisory
• https://spring.io/security/cve-2023-20859 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-20859 · Vendor Advisory
• https://github.com/spring-projects/spring-vault · Note
• https://t.me/cvenotify/46999 · Telegram Post
• https://t.me/cibsecurity/60630 · Telegram Post