CVE-2023-20862: Spring Security logout not clearing security context
6.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.5911%
CWE
Published
4/19/2023
Updated
11/8/2023
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework.security:spring-security-core | maven | >= 5.7.0, < 5.7.8 | 5.7.8 |
| org.springframework.security:spring-security-core | maven | >= 5.8.0, < 5.8.3 | 5.8.3 |
| org.springframework.security:spring-security-core | maven | >= 6.0.0, < 6.0.3 | 6.0.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper cleanup of the security context during logout when using serialized sessions. The HttpSessionSecurityContextRepository's saveContext() method is explicitly called out in the advisory as the component where empty security contexts cannot be properly saved. This matches the CWE-459 (Incomplete Cleanup) classification, as the method fails to completely remove authentication artifacts from the session storage. The method's interaction with Spring Security's explicit save requirements (requireExplicitSave(true)) and serialized session management creates the vulnerability condition where old credentials persist post-logout.