5.5
CVE-2023-20859
- EPSS 0.07%
- Published 23.03.2023 21:15:19
- Last modified 21.11.2024 07:41:42
- Source security@vmware.com
- Teams watchlist Login
- Open Login
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
Data is provided by the National Vulnerability Database (NVD)
VMware ≫ Spring Cloud Config Version >= 3.1.0 <= 3.1.6
VMware ≫ Spring Cloud Config Version >= 4.0.0 <= 4.0.1
VMware ≫ Spring Cloud Vault Version >= 3.1.0 <= 3.1.2
VMware ≫ Spring Cloud Vault Version4.0.0
VMware ≫ Spring Vault Version >= 2.3.0 < 2.3.3
VMware ≫ Spring Vault Version >= 3.0.0 < 3.0.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.07% | 0.173 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
CWE-532 Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.