Spring Session session ID can be logged to the standard output stream
Moderate severity
GitHub Reviewed
Published
Apr 13, 2023
to the GitHub Advisory Database
•
Updated Apr 30, 2023
Package
Affected versions
= 3.0.0
Patched versions
3.0.1
Description
Published by the National Vulnerability Database
Apr 13, 2023
Published to the GitHub Advisory Database
Apr 13, 2023
Reviewed
Apr 17, 2023
Last updated
Apr 30, 2023
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
References