PT-2023-9021 · Spring · Spring Security

Daniel Furtlehner · Published 2023-04-18 · Updated 2024-04-17 · CVE-2023-20862

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.7.x through 5.7.7 Spring Security versions 5.8.x through 5.8.2 Spring Security versions 6.0.x through 6.0.2

Description The issue is related to the logout support not properly cleaning the security context if using serialized versions, and it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This can keep users authenticated even after they performed logout. The vulnerability is associated with incomplete cleanup of temporary or auxiliary resources, allowing a remote attacker to access confidential data or cause a denial of service.

Recommendations For Spring Security versions 5.7.x, upgrade to 5.7.8. For Spring Security versions 5.8.x, upgrade to 5.8.3. For Spring Security versions 6.0.x, upgrade to 6.0.3.

Fix

Weakness Enumeration

CWE-459

Related Identifiers

BDU:2024-03033

CVE-2023-20862

GHSA-X873-6RGC-94JC

RHSA-2024:0778

Affected Products

Spring Security

References · 10

• https://osv.dev/vulnerability/CVE-2023-20862 · Vendor Advisory
• https://spring.io/security/cve-2023-20862 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03033 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20862 · Security Note
• https://osv.dev/vulnerability/GHSA-x873-6rgc-94jc · Vendor Advisory
• https://github.com/spring-projects/spring-security · Note
• https://t.me/cvenotify/51225 · Telegram Post
• https://t.me/pentestingnews/35114 · Telegram Post
• https://security.netapp.com/advisory/ntap-20230526-0002 · Note
• https://t.me/cvenotify/49538 · Telegram Post