Headline
GHSA-r7qr-f43m-pxfr: Spring Session session ID can be logged to the standard output stream
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
Spring Session session ID can be logged to the standard output stream
Moderate severity GitHub Reviewed Published Apr 13, 2023 to the GitHub Advisory Database • Updated Apr 17, 2023
Related news
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.