CVSS 3.1
5.5 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2023-20859
Medium (5.5) in vmware. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in org.springframework.vault:spring-vault-core 2.3.3, 3.0.2.
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
- CWE
- CWE-532
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vmware:spring_cloud_config
- vmware:spring_cloud_vault
- vmware:spring_vault
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r47r-87p9-8jh3 | Maven | org.springframework.vault:spring-vault-core | >=3.0.0 <3.0.2 | 3.0.2 |
| GHSA-r47r-87p9-8jh3 | Maven | org.springframework.vault:spring-vault-core | <2.3.3 | 2.3.3 |