Spring Framework is affected by a sensitive cookie vulnerability that exposes applications to potential cross-site request forgery attacks due to the absence of the SameSite attribute.

This vulnerability involves the improper configuration of the SameSite cookie attribute when using the Jetty 12 Core reactive adapter in WebFlux applications. The lack of this attribute allows for unauthenticated cross-site interactions with sensitive cookies.

The absence of the SameSite attribute significantly increases the risk of cross-site request forgery (CSRF) attacks. While the CVSS score of 7.5 reflects a high severity, the primary business risk involves unauthorized actions performed on behalf of legitimate users, potentially leading to unauthorized data modification or account takeover.

Immediate Action: Review the official Spring security advisory to identify the specific patched versions or configuration updates required to enforce the SameSite attribute.

Proactive Monitoring: Inspect application logs for unusual patterns of cross-site requests or attempts to interact with sensitive session cookies from unexpected origins.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and inject the SameSite attribute into HTTP response headers if immediate application patching is not feasible.

Public Exploit Available: No

This high-severity vulnerability requires immediate attention to protect user sessions from cross-site exploitation. Organizations must prioritize verifying their Spring Framework versions and applying the vendor-provided updates or configuration mitigations as soon as they are released to prevent potential session hijacking and unauthorized request execution.