CVE-2023-20862: netapp active_iq_unified_manager Incomplete Cleanup
Vulnerability summary
CVE-2023-20862 is a medium (CVSS 6.3) Incomplete Cleanup vulnerability in netapp active_iq_unified_manager. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 19-04-2023PublishedVulnerability first disclosed.
- 05-02-2025Last modifiedVulnerability information updated.
Description
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- NVDNIST6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
0.00 pp
From 0.65% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Netapp1 product
Org.springframework.security1 product
- spring-security-core≥ 5.7.0, < 5.7.8 | ≥ 5.8.0, < 5.8.3 | ≥ 6.0.0, < 6.0.3
Vmware1 product
- spring_security≥ 5.7.0, < 5.7.8 | ≥ 5.8.0, < 5.8.3 | ≥ 6.0.0, < 6.0.3
3 vendors · 3 products
References
5 links- security.netapp.com/advisory/ntap-20230526-0002/Third Party Advisory
