Description
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
Remediation
References
https://spring.io/security/cve-2023-20866
Related Vulnerabilities
CVE-2011-2204 Vulnerability in maven package org.apache.tomcat:catalina
CVE-2022-34180 Vulnerability in maven package org.jenkins-ci.plugins:embeddable-build-status
CVE-2016-3737 Vulnerability in maven package org.rhq:rhq-enterprise-comm
CVE-2021-45458 Vulnerability in maven package org.apache.kylin:kylin-core-common
CVE-2023-25722 Vulnerability in maven package com.veracode.jenkins:veracode-scan