Spring Vault, Spring Cloud Vault, Spring Cloud Config
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 13 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Modified
Description
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
Weaknesses (CWE)
- CWE-532 — Insertion of Sensitive Information into Log File
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-r47r-87p9-8jh3 — Spring Vault vulnerable to insertion of sensitive information into a log file
European references
- ENISA EUVD · EUVD-2023-1091
- GCVE · GCVE-0-2023-20859
CERT-FR advisories
- CERTFR-2023-AVI-0513 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*≥ 3.1.0 ≤ 3.1.6cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*≥ 4.0.0 ≤ 4.0.1cpe:2.3:a:vmware:spring_cloud_vault:*:*:*:*:*:*:*:*≥ 3.1.0 ≤ 3.1.2cpe:2.3:a:vmware:spring_cloud_vault:4.0.0:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_vault:*:*:*:*:*:*:*:*≥ 2.3.0 < 2.3.3cpe:2.3:a:vmware:spring_vault:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.0.2
Affected products
| Product | Versions |
|---|---|
| Spring Vault, Spring Cloud Vault, Spring Cloud Config | affected Spring Vault (3.0.0 to 3.0.1, 2.3.0 to 2.3.2), Spring Cloud Vault (4.0.0, 3.1.0 to 3.1.2 and older versions), Spring Cloud Config (4.0.0 to 4.0.1, 3.1.0 to 3.1.6 and older versions) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |