REDHAT-BUG-2463330: Medium severity VMware Spring Boot vulnerability
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2463330?
The severity of REDHAT-BUG-2463330 is considered high due to the potential for local attackers to read sensitive session information.
How do I fix REDHAT-BUG-2463330?
To fix REDHAT-BUG-2463330, update VMware Spring Boot to the latest version that includes the security patch addressing this vulnerability.
Who is affected by REDHAT-BUG-2463330?
REDAHT-BUG-2463330 affects users of VMware Spring Boot versions 2.7.0 to 2.7.32, 3.3.0 to 3.3.18, 3.4.0 to 3.4.15, 3.5.0 to 3.5.13, and 4.0.0 to 4.0.5.
What type of attack does REDHAT-BUG-2463330 allow?
REDAHT-BUG-2463330 may allow a local attacker to take control of the application’s temporary directory and access sensitive session information.
Is REDHAT-BUG-2463330 persistent across application restarts?
Yes, if the server.servlet.session.persistent setting is enabled, the attack can persist across application restarts.