CVE-2023-20862

spring-security: Empty SecurityContext Is Not Properly Saved Upon Logout

Severity Score

6.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

NVD
RedHat

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.

A flaw was found in Spring Security. In affected versions of Spring Security, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout.

*Credits: N/A

CVSS Scores

NISTv3.1 6.3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-11-01 CVE Reserved
2023-04-19 CVE Published
2024-04-25 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-459: Incomplete Cleanup

CAPEC

References (4)

URL	Tag	Source
https://security.netapp.com/advisory/ntap-20230526-0002	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://spring.io/security/cve-2023-20862	2023-08-23
https://access.redhat.com/security/cve/CVE-2023-20862	2024-02-12
https://bugzilla.redhat.com/show_bug.cgi?id=2227788	2024-02-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Vmware Search vendor "Vmware"		Spring Security Search vendor "Vmware" for product "Spring Security"				>= 5.7.0 < 5.7.8 Search vendor "Vmware" for product "Spring Security" and version " >= 5.7.0 < 5.7.8"		-		Affected
Vmware Search vendor "Vmware"		Spring Security Search vendor "Vmware" for product "Spring Security"				>= 5.8.0 < 5.8.3 Search vendor "Vmware" for product "Spring Security" and version " >= 5.8.0 < 5.8.3"		-		Affected
Vmware Search vendor "Vmware"		Spring Security Search vendor "Vmware" for product "Spring Security"				>= 6.0.0 < 6.0.3 Search vendor "Vmware" for product "Spring Security" and version " >= 6.0.0 < 6.0.3"		-		Affected
Netapp Search vendor "Netapp"		Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager"				-		linux		Affected
Netapp Search vendor "Netapp"		Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager"				-		vmware_vsphere		Affected
Netapp Search vendor "Netapp"		Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager"				-		windows		Affected