Описание
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
A flaw was found in Spring Framework's WebFlux when running on the Jetty 12 Core reactive adapter. This flaw causes response cookies to be serialized without the SameSite attribute. This omission can expose users to certain types of cross-site attacks by allowing cookies to be sent in third-party contexts, potentially leading to unintended information disclosure or session manipulation.
Отчет
This vulnerability is rated as Moderate impact because successful exploitation requires user interaction via cross-site requests and only affects environments deploying Spring WebFlux on top of the Jetty 12 Core reactive runtime. In this specific configuration, HTTP response headers omit configured SameSite cookie directives, potentially enabling cross-site request forgery or unintended cookie leakage across origins. Deployments utilizing other embedded web servers or traditional Servlet stacks are not susceptible to this flaw.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat AMQ Broker 7 | jetty-core | Affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | jetty-core | Affected | ||
| Red Hat Fuse 7 | spring-webflux | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
A WebFlux application running on the Jetty 12 Core reactive adapter se ...
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
EPSS
5.4 Medium
CVSS3