CVE-2023-20862
Last modified
CVE-2023-20862 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. EPSS estimates a 0.65% chance of exploitation in the next 30 days.
Description
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Spring Security | >= 5.7.0, < 5.7.8 |
| Vmware | Spring Security | >= 5.8.0, < 5.8.3 |
| Vmware | Spring Security | >= 6.0.0, < 6.0.3 |
| Netapp | Active Iq Unified Manager | All versions |
References
- https://security.netapp.com/advisory/ntap-20230526-0002/Third Party Advisory
- https://spring.io/security/cve-2023-20862Vendor Advisory
- https://security.netapp.com/advisory/ntap-20230526-0002/Third Party Advisory
- https://spring.io/security/cve-2023-20862Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-20862?
How severe is CVE-2023-20862?
How do I fix CVE-2023-20862?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-20857VMware Workspace ONE Content contains a passcode bypass vuln…6.8
- CVE-2023-20858VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x …7.2
- CVE-2023-20859In Spring Vault, versions 3.0.x prior to 3.0.2 and versions …5.5
- CVE-2023-2086The Essential Blocks plugin for WordPress is vulnerable to u…4.3
- CVE-2023-20860Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.…7.5
- CVE-2023-20861In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, …6.5
- CVE-2023-20863In spring framework versions prior to 5.2.24 release+ ,5.3.2…6.5
- CVE-2023-20864VMware Aria Operations for Logs contains a deserialization v…9.8
- CVE-2023-20865VMware Aria Operations for Logs contains a command injection…7.2
- CVE-2023-20866In Spring Session version 3.0.0, the session id can be logge…6.5
- CVE-2023-20867A fully compromised ESXi host can force VMware Tools to fail…3.9
- CVE-2023-20868NSX-T contains a reflected cross-site scripting vulnerabilit…6.1
Are you affected by CVE-2023-20862?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST