CVE-2023-20862
This vulnerability can keep users authenticated even after they performed logout.
Does this matter?
Lower severity and a low EPSS score (0.65%). Track it; it rarely justifies an emergency change on its own.
Description
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
- CVSS 3.1
- 6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- EPSS
- 0.65% probability · 49th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-459
- Affected
- vmware/spring security · netapp/active iq unified manager
- Source
- security@vmware.com
References
- https://security.netapp.com/advisory/ntap-20230526-0002/Third Party Advisory
- https://spring.io/security/cve-2023-20862Vendor Advisory
- https://security.netapp.com/advisory/ntap-20230526-0002/Third Party Advisory
- https://spring.io/security/cve-2023-20862Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.