Vulnerability in NetApp Active Iq Unified Manager
CVE-2023-20862
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.006 (49.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- NetApp Active Iq Unified Manager
- VMware Spring Security
- Spring Security — versions Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- spring.io/security/cve-2023-20862 (Vendor Advisory)
- security.netapp.com/advisory/ntap-20230526-0002/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2023-20862?
- CVE-2023-20862 is a medium-severity vulnerability in NetApp Active Iq Unified Manager, classified under Incomplete Cleanup. CVSS score: 6.3/10. Published 2023-04-19.
- How severe is CVE-2023-20862?
- Medium severity. CVSS v3 base score is 6.3 out of 10.
- Is CVE-2023-20862 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.