CVEvulnerability

CVE-2023-20859

5.5 MEDIUM Published 2023-03-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-03-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532

Description

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.

Affected configurations

• vmware spring cloud config (>= 3.1.0 <= 3.1.6) • vmware spring cloud config (>= 4.0.0 <= 4.0.1) • vmware spring cloud vault (>= 3.1.0 <= 3.1.2) • vmware spring cloud vault 4.0.0 • vmware spring vault (>= 2.3.0 < 2.3.3) • vmware spring vault (>= 3.0.0 < 3.0.2)

Related

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References