Vulnerability Details : CVE-2023-20866
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
Vulnerability category: Information leak
Exploit prediction scoring system (EPSS) score for CVE-2023-20866
Probability of exploitation activity in the next 30 days: 0.05%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 13 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2023-20866
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
[email protected] |
CWE ids for CVE-2023-20866
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: [email protected] (Secondary)
References for CVE-2023-20866
-
https://spring.io/security/cve-2023-20866
Vendor Advisory
Products affected by CVE-2023-20866
- cpe:2.3:a:vmware:spring_session:3.0.0:*:*:*:*:*:*:*