What’s Vulnerable › Vulnerabilities

CVE-2023-20859

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-23 · updated 2026-06-17
• Weakness: CWE-532

Description

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.

Affected products

• Spring Cloud Config: from 3.1.0 through 3.1.6; from 4.0.0 through 4.0.1
• VMware Spring Cloud Vault: from 3.1.0 through 3.1.2; 4.0.0
• VMware Spring Vault: from 2.3.0 before 2.3.3; from 3.0.0 before 3.0.2 — fixed in 2.3.3, 3.0.2
• Spring Vault, Spring Cloud Vault, Spring Cloud Config: from Spring Vault (3.0.0 through 3.0.1, 2.3.0 to 2.3.2), Spring Cloud Vault (4.0.0, 3.1.0 to 3.1.2 and older versions), Spring Cloud Config (4.0.0 to 4.0.1, 3.1.0 to 3.1.6 and older versions)

How to fix

Upgrade to a fixed version: VMware Spring Vault 2.3.3, 3.0.2. Check the vendor advisory for mitigations.

References

• https://spring.io/security/cve-2023-20859
• https://spring.io/security/cve-2023-20859

Get alerted when CVE-2023-20859 or the next vulnerability affects your stack