Improper Logout Implementation

spring-security-web is vulnerable to Improper Logout Implementation. The vulnerability exists in the SwitchUserFilter.java because it does not properly clean the security context if using serialized versions, which allows an attacker to stay authenticated even after they perform a logout...

Spring Security logout not clearing security context

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the...

be.jidoka:jdk-keycloak-admin (2.0.0), br.com.devires.framework.boot:devires-framework-boot-audit (1.1.0) +811 more potentially affected by CVE-2023-20862 via org.springframework.security:spring-security-core (>=6.0.0, <=6.0.2)

org.springframework.security:spring-security-core MAVEN version =6.0.0, =1.1.0, =1.1.0, =0.12.0, =0.12.0, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.4.2 and more Source cves: CVE-2023-20862 Source advisory: OSV:GHSA-X873-6RGC-94JC...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.1.4), be.jidoka:jdk-keycloak-admin (1.3.0) +1650 more potentially affected by CVE-2023-20862 via org.springframework.security:spring-security-core (>=5.7.0, <=5.7.7)

org.springframework.security:spring-security-core MAVEN version =5.7.0, =5.3.1, =6.4.0, =0.0.1, =2.0.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =2.7.0.0, =2.7.7.3, =2.7.7.4, =2.7.0.0, =2.7.0.0, =2.7.1.2, =3.0.0-m2 and more Source cves: CVE-2023-20862 Source advisory: OSV:GHSA-X873-6RGC-94...

GHSA-X873-6RGC-94JC Spring Security logout not clearing security context

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.1.4), be.jidoka:jdk-keycloak-admin (1.3.0) +1650 more potentially affected by CVE-2023-20862 via org.springframework.security:spring-security-core (>=5.7.0, <=5.7.7)

org.springframework.security:spring-security-core MAVEN version =5.7.0, =5.3.1, =6.4.0, =0.0.1, =2.0.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =2.7.0.0, =2.7.7.3, =2.7.7.4, =2.7.0.0, =2.7.0.0, =2.7.1.2, =3.0.0-m2 and more Source cves: CVE-2023-20862 Source advisory: GHSA-X873-6RGC-94JC...

cn.sparrowmini:sparrow-org-service (0.0.1), cn.sparrowmini:sparrow-pem-service (0.0.1) +430 more potentially affected by CVE-2023-20862 via org.springframework.security:spring-security-core (>=5.8.0, <=5.8.2)

org.springframework.security:spring-security-core MAVEN version =5.8.0, =1.48.0, =1.48.0, =1.48.0, =2.4.0, =2.4.0, =2.4.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =3.7.2 - com.github.waffle.demo:waffle-spring-boot-filter2 3.3.0 - com.github.waffle.demo:waffle-spring-filter 3.3.0 -...

cn.sparrowmini:sparrow-org-service (0.0.1), cn.sparrowmini:sparrow-pem-service (0.0.1) +430 more potentially affected by CVE-2023-20862 via org.springframework.security:spring-security-core (>=5.8.0, <=5.8.2)

org.springframework.security:spring-security-core MAVEN version =5.8.0, =1.48.0, =1.48.0, =1.48.0, =2.4.0, =2.4.0, =2.4.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =3.7.2 - com.github.waffle.demo:waffle-spring-boot-filter2 3.3.0 - com.github.waffle.demo:waffle-spring-filter 3.3.0 -...

be.jidoka:jdk-keycloak-admin (2.0.0), br.com.devires.framework.boot:devires-framework-boot-audit (1.1.0) +811 more potentially affected by CVE-2023-20862 via org.springframework.security:spring-security-core (>=6.0.0, <=6.0.2)

org.springframework.security:spring-security-core MAVEN version =6.0.0, =1.1.0, =1.1.0, =0.12.0, =0.12.0, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.4.2 and more Source cves: CVE-2023-20862 Source advisory: GHSA-X873-6RGC-94JC...

CVE-2023-20862

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the...

Design/Logic Flaw

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the...

CVE-2023-20862: Incomplete Cleanup

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the...

CVE-2023-20862

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the...

be.jidoka:jdk-keycloak-admin (2.0.0), br.com.devires.framework.boot:devires-framework-boot-audit (1.1.0) +811 more potentially affected by CVE-2023-20862 via org.springframework.security:spring-security-core (>=6.0.0, <=6.0.2)

org.springframework.security:spring-security-core MAVEN version =6.0.0, =1.1.0, =1.1.0, =0.12.0, =0.12.0, =0.12.0, =0.13.0, =3.0.1.0, =3.0.1.0, =3.0.4.2 and more Source cves: CVE-2023-20862 Source advisory: MEND:CVE-2023-20862...

CVE-2023-20862

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the...

CVE-2023-20862

In CVE-2023-20862, the Spring Security logout flow fails to properly clean the security context when serialized contexts are used, and saving an empty security context to HttpSessionSecurityContextRepository is blocked. Affected versions are Spring Security 5.7.x prior to 5.7.8, 5.8.x prior to 5....

Spring Framework security vulnerabilities

Spring Framework is the U.S. Spring team of a set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications . A security vulnerability exists in Spring Security 5.7.x series prior to 5.7.8, 5.8.x series prior to 5.8.3, and 6.0.x series prior...

CVE-2023-20862

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.1.4), be.jidoka:jdk-keycloak-admin (1.3.0) +1650 more potentially affected by CVE-2023-20862 via org.springframework.security:spring-security-core (>=5.7.0, <=5.7.7)

org.springframework.security:spring-security-core MAVEN version =5.7.0, =5.3.1, =6.4.0, =0.0.1, =2.0.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =0.0.1-alpha.1, =2.7.0.0, =2.7.7.3, =2.7.7.4, =2.7.0.0, =2.7.0.0, =2.7.1.2, =3.0.0-m2 and more Source cves: CVE-2023-20862 Source advisory: MEND:CVE-2023-20862...

cn.sparrowmini:sparrow-org-service (0.0.1), cn.sparrowmini:sparrow-pem-service (0.0.1) +430 more potentially affected by CVE-2023-20862 via org.springframework.security:spring-security-core (>=5.8.0, <=5.8.2)

org.springframework.security:spring-security-core MAVEN version =5.8.0, =1.48.0, =1.48.0, =1.48.0, =2.4.0, =2.4.0, =2.4.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =3.7.2 - com.github.waffle.demo:waffle-spring-boot-filter2 3.3.0 - com.github.waffle.demo:waffle-spring-filter 3.3.0 -...