Spring Vault, Spring Cloud Vault, Spring Cloud Config
En bref
- Source
- NVD
- EPSS
- EPSS 0.22 % · centile 13 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- vmware
- Statut NVD
- Modified
Description
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
Faiblesses (CWE)
- CWE-532 — Informations sensibles insérées dans un fichier de journal
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-r47r-87p9-8jh3 — Spring Vault vulnerable to insertion of sensitive information into a log file
Références européennes
- ENISA EUVD · EUVD-2023-1091
- GCVE · GCVE-0-2023-20859
Avis du CERT-FR
- CERTFR-2023-AVI-0513 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*≥ 3.1.0 ≤ 3.1.6cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*≥ 4.0.0 ≤ 4.0.1cpe:2.3:a:vmware:spring_cloud_vault:*:*:*:*:*:*:*:*≥ 3.1.0 ≤ 3.1.2cpe:2.3:a:vmware:spring_cloud_vault:4.0.0:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_vault:*:*:*:*:*:*:*:*≥ 2.3.0 < 2.3.3cpe:2.3:a:vmware:spring_vault:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.0.2
Produits affectés
| Produit | Versions |
|---|---|
| Spring Vault, Spring Cloud Vault, Spring Cloud Config | affected Spring Vault (3.0.0 to 3.0.1, 2.3.0 to 2.3.2), Spring Cloud Vault (4.0.0, 3.1.0 to 3.1.2 and older versions), Spring Cloud Config (4.0.0 to 4.0.1, 3.1.0 to 3.1.6 and older versions) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |