CVE-2023-20862 — Incomplete Cleanup in Vmware Spring Security

CWE-459 — Incomplete Cleanup7 documents6 sources
Severity
6.3MEDIUMNVD
EPSS
0.4%
top 39.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Vmware Spring Security
Timeline
PublishedApr 19
Latest updateOct 15

Description

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages2 packages

▶NVDvmware/spring_security5.7.0 — 5.7.8+2
▶CVEListV5vmware/spring_securitySpring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3

🔴Vulnerability Details

3
GHSA
Spring Security logout not clearing security context↗2023-04-19
▶
CVEList
CVE-2023-20862: In Spring Security, versions 5↗2023-04-19
▶
OSV
Spring Security logout not clearing security context↗2023-04-19
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Installer (Spring Security) — CVE-2023-20862↗2023-10-15
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: Security (Spring Security) — CVE-2023-20862↗2023-07-15
▶
Red Hat
spring-security: Empty SecurityContext Is Not Properly Saved Upon Logout↗2023-04-19
▶
CVE-2023-20862 — Incomplete Cleanup in Vmware | cvebase