medium5.5
CVE-2023-20859
Spring Vault vulnerable to insertion of sensitive information into a log file
Impact
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.vault:spring-vault-core | >= 3.0.0, < 3.0.2 | 3.0.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Cloud Config | from 3.1.0 through 3.1.6 from 4.0.0 through 4.0.1 |
| Vmware | Spring Cloud Vault | from 3.1.0 through 3.1.2 Version 4.0.0 |
| Vmware | Spring Vault | from 2.3.0 before 2.3.3 from 3.0.0 before 3.0.2 |