Medium severity · published Apr 19, 2023
CVE-2023-20862
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security…
6.3
CVSS
0.6%
EPSS
No
On KEV
Description
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
SS
Spring Security · Vmware
5.7.0 before 5.7.8; 5.8.0 before 5.8.3; 6.0.0 before 6.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-20862
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-20862
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230526-0002/
Vendor Advisory
https://spring.io/security/cve-2023-20862
More from Active IQ Unified Manager
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
8.8
CVE-2023-41993
Apple Multiple Products WebKit Code Execution Vulnerability
8.8
CVE-2023-4863
Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
8.1
CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g