CVE-2023-20859

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-20859
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-20859.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-20859
Aliases
Published
2023-03-23T00:00:00Z
Modified
2026-07-08T06:32:35.612742254Z
Summary
[none]
Details

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "Spring Vault (3.0.0 to 3.0.1, 2.3.0 to 2.3.2), Spring Cloud Vault (4.0.0, 3.1.0 to 3.1.2 and older versions), Spring Cloud Config (4.0.0 to 4.0.1, 3.1.0 to 3.1.6 and older versions)"
                },
                {
                    "last_affected": "Spring Vault (3.0.0 to 3.0.1, 2.3.0 to 2.3.2), Spring Cloud Vault (4.0.0, 3.1.0 to 3.1.2 and older versions), Spring Cloud Config (4.0.0 to 4.0.1, 3.1.0 to 3.1.6 and older versions)"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/20xxx/CVE-2023-20859.json",
    "cna_assigner": "vmware"
}
References

Affected packages

Git
github.com/spring-cloud/spring-cloud-config

Affected ranges

Type
GIT
Repo
https://github.com/spring-cloud/spring-cloud-config
Events
Introduced
8e927ed0f1fdac72a30808e96d12e541a6bc7533
Last affected
6693d86d8b1af5aa72ba616310979ddeda5bbc83
Introduced
677653fcf2a76aea5c5b599c576d231dd1ba0f30
Last affected
147149b1c2f18b691552bf96e5fc913733832238
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.1.0"
        },
        {
            "last_affected": "3.1.6"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.0.1"
        }
    ]
}

Affected versions

v3.*
v3.1.0
v3.1.1
v3.1.2
v3.1.4
v3.1.5
v3.1.6
v4.*
v4.0.0
v4.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-20859.json"
github.com/spring-cloud/spring-cloud-vault

Affected ranges

Type
GIT
Repo
https://github.com/spring-cloud/spring-cloud-vault
Events
Introduced
79a423d123bfb11d183834f32e1cbf9ff3d826b5
Last affected
d105249a9f9525d21fd920f1935b22d79bbd4873
Introduced
57ee50c625c6552feca4eb1c9a138130c31a55e1
Last affected
57ee50c625c6552feca4eb1c9a138130c31a55e1
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:vmware:spring_cloud_vault:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:vmware:spring_cloud_vault:4.0.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.1.0"
        },
        {
            "last_affected": "3.1.2"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.0.0"
        }
    ]
}

Affected versions

4.*
4.0.0
v3.*
v3.1.0
v3.1.1
v3.1.2
v4.*
v4.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-20859.json"