Vulnerability in Netapp Active Iq Unified Manager
CVE-2023-20862
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
EPSS: 0.006 (47.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Netapp Active_iq_unified_manager
- Vmware Spring_security
- N/a Spring Security — versions Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@vmware.com (Vendor Advisory)
- security@vmware.com (Third Party Advisory)
Frequently asked questions
- What is CVE-2023-20862?
- CVE-2023-20862 is a medium-severity vulnerability in Netapp Active Iq Unified Manager, classified under Incomplete Cleanup. CVSS score: 6.3/10. Published 2023-04-19.
- How severe is CVE-2023-20862?
- Medium severity. CVSS v3 base score is 6.3 out of 10.
- Is CVE-2023-20862 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.