CVE-2023-20862

    Dashboard / Vulnerabilities / CVE-2023-20862

    CVE-2023-20862

    Published: 19 Apr 2023Last Modified: 12 Aug 2026

    Summary:

    Details: In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.

    References: https://spring.io/security/cve-2023-20862, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/20xxx/CVE-2023-20862.json, https://nvd.nist.gov/vuln/detail/CVE-2023-20862, https://security.netapp.com/advisory/ntap-20230526-0002/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 3497b0ed68a2cc373d4105c66308dfe0dd624333
    Fixed -d6eeafb10cbe7e96be5077a1b7cf0afee5f673f4

    Affected versions

    5.7.7
    5.7.6
    5.7.5
    5.7.4
    5.7.3
    5.7.2
    5.7.1
    5.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-20862 | CVE-DB