GHSA-r7qr-f43m-pxfr

Source

https://github.com/advisories/GHSA-r7qr-f43m-pxfr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-r7qr-f43m-pxfr/GHSA-r7qr-f43m-pxfr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r7qr-f43m-pxfr

Aliases

CVE-2023-20866

Published

2023-04-13T21:30:27Z

Modified

2023-11-08T04:11:22.567296Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Spring Session session ID can be logged to the standard output stream

Details

In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.

Database specific

{
    "nvd_published_at": "2023-04-13T20:15:00Z",
    "github_reviewed_at": "2023-04-17T17:14:40Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-200"
    ]
}

References

Affected packages

Maven / org.springframework.session:spring-session-core

Package

Name: org.springframework.session:spring-session-core; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.session/spring-session-core

GHSA-r7qr-f43m-pxfr

Affected packages

Maven / org.springframework.session:spring-session-core

Package

Affected ranges

Affected versions

3.*