Session Fixation Affecting org.springframework.security:spring-security-web package, versions [5.7.0,5.7.8) [5.8.0,5.8.3) [6.0.0,6.0.3)


Severity

0.0
medium
0
10

    Threat Intelligence

    EPSS
    0.07% (30th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-5430964
  • published 20 Apr 2023
  • disclosed 20 Apr 2023
  • credit Daniel Furtlehner

How to fix?

Upgrade org.springframework.security:spring-security-web to version 5.7.8, 5.8.3, 6.0.3 or higher.

Overview

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Session Fixation due to the logout functionality not properly clearing the security context when using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This allows users to stay authenticated after a logout.

NOTE: Applications are only vulnerable if any of the following conditions are true:

  • The SecurityContextHolderFilter or requireExplicitSave(true) is in use with logout support for serialized sessions, and invalidateHttpSession(false).

  • Users are logged out manually by saving an empty SecurityContext into the HttpSessionSecurityContextRepository.

  • A custom SecurityContextRepository is in use that does not rely on the HttpSession.

CVSS Scores

version 3.1
Expand this section

Snyk

5.9 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    Low
  • Availability (A)
    None
Expand this section

NVD

6.3 medium
Expand this section

Red Hat

6.3 medium