{"action":"Upgrade org.springframework.session:spring-session-core to 3.0.1 or later.","affected":[{"fixed":"3.0.1","introduced":"3.0.0"}],"component":"org.springframework.session:spring-session-core","cve_ids":["CVE-2023-20866"],"ecosystem":"Maven","epss":0.0066,"exploited":false,"fixed_versions":["3.0.1"],"ghsa_id":"GHSA-r7qr-f43m-pxfr","id":"tcs_01M5N9B7MH8H7A1HA8V8JGBYAM","modified_at":"2023-11-08T04:11:22.567296Z","published_at":"2023-04-13T21:30:27Z","references":["https://osv.dev/vulnerability/GHSA-r7qr-f43m-pxfr","https://nvd.nist.gov/vuln/detail/CVE-2023-20866","https://github.com/spring-projects/spring-session/issues/2215","https://github.com/spring-projects/spring-session/commit/c98a7be0e2ced7f795018f05397dca4bd5ca8212","https://github.com/spring-projects/spring-session","https://spring.io/security/cve-2023-20866"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-r7qr-f43m-pxfr","url":"https://osv.dev/vulnerability/GHSA-r7qr-f43m-pxfr"}],"summary":"Spring Session session ID can be logged to the standard output stream"}