GHSA-x873-6rgc-94jc

    Dashboard / Vulnerabilities / GHSA-x873-6rgc-94jc

    GHSA-x873-6rgc-94jc

    Published: 19 Apr 2023Last Modified: 16 Feb 2024

    Summary: Spring Security logout not clearing security context

    Details: In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.

    References: https://nvd.nist.gov/vuln/detail/CVE-2023-20862, https://github.com/spring-projects/spring-security, https://security.netapp.com/advisory/ntap-20230526-0002, https://spring.io/security/cve-2023-20862

    Affected packages

    Package

    Name: org.springframework.security:spring-security-core

    Purl: pkg:maven/org.springframework.security/spring-security-core

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 5.7.0
    Fixed -5.7.8

    Affected versions

    5.7.0
    5.7.1
    5.7.2
    5.7.3
    5.7.4
    5.7.5
    5.7.6
    5.7.7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-x873-6rgc-94jc | CVE-DB