Design/Logic Flaw

2023-03-2321:15:00

PRIOn knowledge base

www.prio-n.com

spring vault

vulnerability

sensitive information

log file

revocation

batch token

5.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.

CPENameOperatorVersion
spring_cloud_configge4.0.0
spring_cloud_configle4.0.1
spring_cloud_configge3.1.0
spring_cloud_configle3.1.6
spring_cloud_vaulteq4.0.0
spring_cloud_vaultge3.1.0
spring_cloud_vaultle3.1.2
spring_vaultge3.0.0
spring_vaultlt3.0.2
spring_vaultge2.3.0

Name	Operator	Version
spring_cloud_config	ge	4.0.0
spring_cloud_config	le	4.0.1
spring_cloud_config	ge	3.1.0
spring_cloud_config	le	3.1.6
spring_cloud_vault	eq	4.0.0
spring_cloud_vault	ge	3.1.0
spring_cloud_vault	le	3.1.2
spring_vault	ge	3.0.0
spring_vault	lt	3.0.2
spring_vault	ge	2.3.0