CVE-2023-20866

In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.

• CWE-200
• CWE-200

• https://spring.io/security/cve-2023-20866Vendor Advisory
• https://spring.io/security/cve-2023-20866Vendor Advisory

Published

Apr 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-20860Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.…7.5
• CVE-2023-20861In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, …6.5
• CVE-2023-20862In Spring Security, versions 5.7.x prior to 5.7.8, versions …6.3
• CVE-2023-20863In spring framework versions prior to 5.2.24 release+ ,5.3.2…6.5
• CVE-2023-20864VMware Aria Operations for Logs contains a deserialization v…9.8
• CVE-2023-20865VMware Aria Operations for Logs contains a command injection…7.2
• CVE-2023-20867A fully compromised ESXi host can force VMware Tools to fail…3.9
• CVE-2023-20868NSX-T contains a reflected cross-site scripting vulnerabilit…6.1
• CVE-2023-20869VMware Workstation (17.x) and VMware Fusion (13.x) contain a…8.2
• CVE-2023-2087The Essential Blocks plugin for WordPress is vulnerable to C…4.3
• CVE-2023-20870VMware Workstation and Fusion contain an out-of-bounds read …6
• CVE-2023-20871VMware Fusion contains a local privilege escalation vulnerab…7.8