org.springframework.session vulnerabilities

Products

• org.springframework.session/spring-session-core 1

Latest org.springframework.session CVEs

Newest publication first

1. CVE-2023-20866 Spring Session session ID can be logged to the standard output stream

   Published 2023-04-13

   Medium·CVSS 6.5

   In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it i...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.