GHSA-r47r-87p9-8jh3MediumCVSS 5.5

Spring Vault vulnerable to insertion of sensitive information into a log file

Published
March 23, 2023
Last Modified
March 28, 2023

🔗 CVE IDs covered (1)

CVE-2023-20859 →

📋 Description

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.

🎯 Affected products2

  • maven/org.springframework.vault:spring-vault-core:>= 3.0.0, < 3.0.2
  • maven/org.springframework.vault:spring-vault-core:< 2.3.3

🔗 References (3)