CVE-2023-20862 is a medium-severity vulnerability affecting the logout support in Spring Security, a popular framework for building Java applications. Systems running specific versions of Spring Security are affected, including those used in various NetApp products and VMware's Spring Security. It is crucial for organizations to update their systems to the latest, patched versions to mitigate this vulnerability.

How do I know if I'm affected?

To determine if you're affected by the CVE-2023-20862 vulnerability, check if your system is running Spring Security in the following versions: 5.7.x prior to 5.7.8, 5.8.x prior to 5.8.3, or 6.0.x prior to 6.0.3. Additionally, NetApp's Active IQ Unified Manager on Linux, VMware vSphere, and Windows may also be affected. If your system uses any of these versions, it is vulnerable and should be updated to a patched version.

What should I do if I'm affected?

If you're affected by this vulnerability, update your Spring Security to a patched version: 5.7.8 for 5.7.x users, 5.8.3 for 5.8.x users, or 6.0.3 for 6.0.x users. For NetApp products, obtain software fixes from the NetApp Support website or contact NetApp Technical Support. Always keep your software up-to-date to prevent security risks.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-20862 vulnerability, also known as Incomplete Cleanup in Spring Security, is not listed in CISA's Known Exploited Vulnerabilities Catalog. This issue can keep users authenticated even after they have logged out, potentially leading to unauthorized access and other security risks.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-459 as an incomplete cleanup issue in Spring Security, which can lead to unauthorized access after logout.

For more details

CVE-2023-20862 is a medium-severity vulnerability affecting Spring Security, with potential consequences such as unauthorized access and security risks. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the links below.

• NetApp Product Security

• Spring Security Advisory