VDB
CVE-2023-20859
CVE-2023-20859
PUBLISHED
CVSS 5.5 MEDIUM
Spring Vault vulnerable to insertion of sensitive information into a log file
EPSS 0.22% · 12.1th percentile
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.22%
12.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | Spring Vault, Spring Cloud Vault, Spring Cloud Config | Spring Vault (3.0.0 to 3.0.1, 2.3.0 to 2.3.2), Spring Cloud Vault (4.0.0, 3.1.0 to 3.1.2 and older versions), Spring Cloud Config (4.0.0 to 4.0.1, 3.1.0 to 3.1.6 and older versions) |
| vmware | spring_vault | 3.0.0, 2.3.0 |
| vmware | spring_cloud_config | 3.1.0, 4.0.0 |
| Maven | org.springframework.vault:spring-vault-core | 3.0.0, 0 |
| vmware | spring_cloud_vault | 4.0.0, 3.1.0 |
Timeline
- Mar 23, 2023 CVE Published
- Mar 23, 2023 PoC Published
- Mar 24, 2023 EPSS Score
- May 2, 2023 EPSS Score
- Jun 10, 2023 EPSS Score
- Jul 18, 2023 EPSS Score
- Aug 26, 2023 EPSS Score
- Oct 4, 2023 EPSS Score
- Nov 12, 2023 EPSS Score
- Dec 21, 2023 EPSS Score
- Jan 28, 2024 EPSS Score
- Mar 7, 2024 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-20859 advisory
- https://github.com/spring-projects/spring-vault package
- https://spring.io/security/cve-2023-20859 url
- https://www.ibm.com/support/pages/node/7010099 advisory
- https://www.ibm.com/support/pages/node/7009987 advisory
- https://www.ibm.com/support/pages/node/7009301 advisory
- https://www.ibm.com/support/pages/node/7010095 advisory