GHSA-r7qr-f43m-pxfr
Spring Session session ID can be logged to the standard output stream
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.session:spring-session-core | >= 3.0.0, < 3.0.1 | 3.0.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
References
External links from the advisory. They lead to third-party sites.