PT-2023-17681 · Unknown · Spring Session

Benedikt Halser · Published 2023-04-13 · Updated 2023-04-21 · CVE-2023-20866

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring Session version 3.0.0

Description The session id can be logged to the standard output stream, exposing sensitive information to those who have access to the application logs. This can be used for session hijacking, specifically in applications using HeaderHttpSessionIdResolver.

Recommendations For Spring Session version 3.0.0, consider disabling the HeaderHttpSessionIdResolver to minimize the risk of exploitation until a patch is available. Restrict access to application logs to prevent unauthorized access to sensitive session information.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-20866

GHSA-R7QR-F43M-PXFR

Affected Products

Spring Session

References · 9

• https://osv.dev/vulnerability/CVE-2023-20866 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r7qr-f43m-pxfr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20866 · Security Note
• https://spring.io/security/cve-2023-20866 · Vendor Advisory
• https://github.com/spring-projects/spring-session · Note
• https://github.com/spring-projects/spring-session/commit/c98a7be0e2ced7f795018f05397dca4bd5ca8212 · Note
• https://github.com/spring-projects/spring-session/issues/2215 · Note
• https://t.me/cvenotify/48856 · Telegram Post
• https://t.me/cibsecurity/62083 · Telegram Post