Описание
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
A flaw was found in Spring Framework. A remote attacker, by compromising a subdomain of a WebFlux application (for example, through cross-site scripting (XSS)), could exploit this vulnerability to escalate privileges. This allows the attacker to exchange a known session ID for that of an authenticated user, potentially leading to unauthorized access to the application.
Отчет
A flaw was found in Spring Framework. A WebFlux application with a compromised subdomain is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | spring-web | Fix deferred | ||
| Red Hat OpenShift Dev Spaces | spring-web | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
4.2 Medium
CVSS3
Связанные уязвимости
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
A WebFlux application with a compromised subdomain (for example, compr ...
Spring Framework Escalation via Session Fixation in WebFlux
EPSS
4.2 Medium
CVSS3