Information disclosure in Vmware Spring Session
CVE-2023-20866
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
Vulnerability class: Information Disclosure
EPSS: 0.007 (47.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Vmware Spring_session — versions 3.0.0
- N/a Spring Session — versions Spring session versions 3.0.x prior to 3.0.1
Weakness classification (CWE)
References
- security@vmware.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-20866?
- CVE-2023-20866 is a medium-severity vulnerability in Vmware Spring Session, classified under Information Disclosure. CVSS score: 6.5/10. Published 2023-04-13.
- How severe is CVE-2023-20866?
- Medium severity. CVSS v3 base score is 6.5 out of 10.