Spring Framework Session Fixation Vulnerability in WebFlux Applications

A session fixation vulnerability has been identified in Spring Framework's WebFlux applications. This issue arises when a subdomain is compromised, potentially through cross-site scripting (XSS). The vulnerability allows an attacker to exchange a known session ID for that of an authenticated user, leading to unauthorized access. Affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.

Impact

Exploitation of this vulnerability allows for session fixation attacks, where an attacker can hijack an authenticated user's session by exchanging session IDs.

Remediation

Users should upgrade to Spring Framework 7.0.8, 6.2.19, 6.1.28, or 5.3.49. Instructions for upgrading to the commercial versions are available on the Spring Enterprise website.