CVE-2023-20859

2023-03-2321:15:19

CWE-532

[email protected]

web.nvd.nist.gov

404

spring vault

cve-2023-20859

information security

vulnerability

log file insertion

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.2%

JSON

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.

Affected configurations

NVD

Node

vmwarespring_cloud_configRange3.1.0–3.1.6

vmwarespring_cloud_configRange4.0.0–4.0.1

vmwarespring_cloud_vaultRange3.1.0–3.1.2

vmwarespring_cloud_vaultMatch4.0.0

vmwarespring_vaultRange2.3.0–2.3.3

vmwarespring_vaultRange3.0.0–3.0.2

CPENameOperatorVersion
vmware:spring_cloud_configvmware spring cloud configle3.1.6
vmware:spring_cloud_configvmware spring cloud configle4.0.1
vmware:spring_cloud_vaultvmware spring cloud vaultle3.1.2
vmware:spring_cloud_vaultvmware spring cloud vaulteq4.0.0
vmware:spring_vaultvmware spring vaultlt2.3.3
vmware:spring_vaultvmware spring vaultlt3.0.2

CPE	Name	Operator	Version
vmware:spring_cloud_config	vmware spring cloud config	le	3.1.6
vmware:spring_cloud_config	vmware spring cloud config	le	4.0.1
vmware:spring_cloud_vault	vmware spring cloud vault	le	3.1.2
vmware:spring_cloud_vault	vmware spring cloud vault	eq	4.0.0
vmware:spring_vault	vmware spring vault	lt	2.3.3
vmware:spring_vault	vmware spring vault	lt	3.0.2

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Spring Vault, Spring Cloud Vault, Spring Cloud Config",
    "versions": [
      {
        "version": "Spring Vault (3.0.0 to 3.0.1, 2.3.0 to 2.3.2), Spring Cloud Vault (4.0.0, 3.1.0 to 3.1.2 and older versions), Spring Cloud Config (4.0.0 to 4.0.1, 3.1.0 to 3.1.6 and older versions)",
        "status": "affected"
      }
    ]
  }
]