{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Spring Security ist ein Framework, das Authentifizierung, Autorisierung und Schutz vor g\u00e4ngigen Angriffen bietet.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in VMware Tanzu Spring Security ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-0994 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0994.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-0994 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0994"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7003901 vom 2023-07-20",
        "url": "https://www.ibm.com/support/pages/node/7003901"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7001787 vom 2023-06-07",
        "url": "https://www.ibm.com/support/pages/node/7001787"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20230526-0002 vom 2023-05-26",
        "url": "https://security.netapp.com/advisory/ntap-20230526-0002/"
      },
      {
        "category": "external",
        "summary": "Spring Framework Security Advisory vom 2023-04-17",
        "url": "https://spring.io/blog/2023/04/17/spring-security-6-1-0-rc1-6-0-3-5-8-3-and-5-7-8-released-fix-cve-2023-20862"
      }
    ],
    "source_lang": "en-US",
    "title": "VMware Tanzu Spring Security: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2023-07-20T22:00:00.000+00:00",
      "generator": {
        "date": "2024-02-15T17:24:13.013+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2023-0994",
      "initial_release_date": "2023-04-17T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-04-17T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-05-29T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von NetApp aufgenommen"
        },
        {
          "date": "2023-06-06T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-07-20T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "IBM Operational Decision Manager 8.10.x",
                "product": {
                  "name": "IBM Operational Decision Manager 8.10.x",
                  "product_id": "T027827",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:operational_decision_manager:8.10.x"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "IBM Operational Decision Manager 8.11.x",
                "product": {
                  "name": "IBM Operational Decision Manager 8.11.x",
                  "product_id": "T027828",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:operational_decision_manager:8.11.x"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Operational Decision Manager"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "NetApp ActiveIQ Unified Manager for Linux",
                "product": {
                  "name": "NetApp ActiveIQ Unified Manager for Linux",
                  "product_id": "T023548",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netapp:active_iq_unified_manager:for_linux"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "NetApp ActiveIQ Unified Manager for VMware vSphere",
                "product": {
                  "name": "NetApp ActiveIQ Unified Manager for VMware vSphere",
                  "product_id": "T025152",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "NetApp ActiveIQ Unified Manager for Microsoft Windows",
                "product": {
                  "name": "NetApp ActiveIQ Unified Manager for Microsoft Windows",
                  "product_id": "T025631",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ActiveIQ Unified Manager"
          }
        ],
        "category": "vendor",
        "name": "NetApp"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "VMware Tanzu Spring Security \u003c 5.7.8",
                "product": {
                  "name": "VMware Tanzu Spring Security \u003c 5.7.8",
                  "product_id": "T027315",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_security:5.7.8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "VMware Tanzu Spring Security \u003c 5.8.3",
                "product": {
                  "name": "VMware Tanzu Spring Security \u003c 5.8.3",
                  "product_id": "T027316",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_security:5.8.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "VMware Tanzu Spring Security \u003c 6.0.3",
                "product": {
                  "name": "VMware Tanzu Spring Security \u003c 6.0.3",
                  "product_id": "T027317",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_security:6.0.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "VMware Tanzu Spring Security \u003c 6.1.0-RC1",
                "product": {
                  "name": "VMware Tanzu Spring Security \u003c 6.1.0-RC1",
                  "product_id": "T027318",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_security:6.1.0-rc1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spring Security"
          }
        ],
        "category": "vendor",
        "name": "VMware Tanzu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-20862",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in VMware Tanzu Spring Security. Beim Logout eines Nutzers kann es zu einem Fehler beim Speichern von \"SecurityContext\" kommen. In Folge bleibt der betroffene Nutzer immer noch authentisiert. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T023548",
          "T025152",
          "T027827",
          "T027828",
          "T025631"
        ]
      },
      "release_date": "2023-04-17T22:00:00Z",
      "title": "CVE-2023-20862"
    }
  ]
}