CVE-2023-20862

moderate-risk
Published 2023-04-19

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.

Do I need to act?

-
0.40% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.3/10 Medium
NETWORK / LOW complexity

Affected Products (4)

Affected Vendors

Vmware Netapp

References (4)

Third Party Advisory https://security.netapp.com/advisory/ntap-20230526-0002/
Vendor Advisory https://spring.io/security/cve-2023-20862
Third Party Advisory https://security.netapp.com/advisory/ntap-20230526-0002/
Vendor Advisory https://spring.io/security/cve-2023-20862
35
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 2/34 · Minimal
Exposure 10/34 · Low