Read the docs
TI-2023-07278 Aliases CVE-2023-20859GHSA-r47r-87p9-8jh3

Sensitive information in log files in Spring Vault, Spring Cloud Vault, Spring Cloud…

Priority LOW 24CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00223 12th percentileScored 2026-11-07
Fix Fixed org.springframework.vault:spring-vault-core (Maven): 3.0.2, 2.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Spring Vault, Spring Cloud Vault, Spring Cloud ConfigSpring Vault (3.0.0 to 3.0.1, 2.3.0 to 2.3.2), Spring Cloud Vault (4.0.0, 3.1.0 to 3.1.2 and older versions), Spring Cloud Config (4.0.0 to 4.0.1, 3.1.0 to 3.1.6 and older versions)—No fix listedCNA
—org.springframework.vault:spring-vault-core (Maven)3.0.0 to before 3.0.23.0.2Patch availableGHSA-r47r-87p9-8jh3
—org.springframework.vault:spring-vault-core (Maven)before 2.3.32.3.3Patch availableGHSA-r47r-87p9-8jh3
  • Spring Vault, Spring Cloud Vault, Spring Cloud Config Vendor— Affected Spring Vault (3.0.0 to 3.0.1, 2.3.0 to 2.3.2), Spring Cloud Vault (4.0.0, 3.1.0 to 3.1.2 and older versions), Spring Cloud Config (4.0.0 to 4.0.1, 3.1.0 to 3.1.6 and older versions) Fixed in — No fix listed CNA
  • org.springframework.vault:spring-vault-core (Maven) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-r47r-87p9-8jh3
  • org.springframework.vault:spring-vault-core (Maven) Vendor— Affected before 2.3.3 Fixed in 2.3.3 Patch available GHSA-r47r-87p9-8jh3

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*3.1.0 – 3.1.6; 4.0.0 – 4.0.1VulnerableVMware
cpe:2.3:a:vmware:spring_cloud_vault:*:*:*:*:*:*:*:*3.1.0 – 3.1.2VulnerableVMware
cpe:2.3:a:vmware:spring_cloud_vault:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableVMware
cpe:2.3:a:vmware:spring_vault:*:*:*:*:*:*:*:*2.3.0 to before 2.3.3; 3.0.0 to before 3.0.2VulnerableVMware
  • cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:* Versions 3.1.0 – 3.1.6; 4.0.0 – 4.0.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_cloud_vault:*:*:*:*:*:*:*:* Versions 3.1.0 – 3.1.2 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_cloud_vault:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_vault:*:*:*:*:*:*:*:* Versions 2.3.0 to before 2.3.3; 3.0.0 to before 3.0.2 Vulnerable ·VMware

Remediation

  • Fix · GHSA-r47r-87p9-8jh3 org.springframework.vault:spring-vault-core (Maven) Fixed in 3.0.2 Advisory →
  • Fix · GHSA-r47r-87p9-8jh3 org.springframework.vault:spring-vault-core (Maven) Fixed in 2.3.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-20859
  2. 2026-10-03 Alias added: GHSA-r47r-87p9-8jh3

References

Advisory 2

Other 1

  • TI-2020-04456 Directory Traversal with spring-cloud-config-server KEVCVSS 3.1HIGH 7.5
  • TI-2019-02811 Directory Traversal with spring-cloud-config-server CVSS 3.1MEDIUM 6.5
  • TI-2020-04451 Directory Traversal with spring-cloud-config-server CVSS 3.1MEDIUM 6.5
  • TI-2026-29633 Path traversal in VMware Spring Cloud Config CVSS 3.1CRITICAL 9.1
  • TI-2026-18263 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks CVSS 3.1HIGH 8.6
  • TI-2026-35289 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests CVSS 3.1CRITICAL 9.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences