CVE-2020-5398
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
- CVSS 3.1
- 7.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 88% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-494, CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- netapp:data_availability_services
- netapp:snapcenter
- oracle:application_testing_suite
- oracle:communications_billing_and_revenue_management_elastic_charging_engine
- oracle:communications_cloud_native_core_policy
- oracle:communications_diameter_signaling_router
- oracle:communications_element_manager
- oracle:communications_policy_management
- oracle:communications_session_report_manager
- oracle:communications_session_route_manager
- oracle:enterprise_manager_base_platform
- oracle:financial_services_regulatory_reporting_with_agilereporter
- oracle:flexcube_private_banking
- oracle:healthcare_master_person_index
- oracle:insurance_calculation_engine
- oracle:insurance_policy_administration_j2ee
- oracle:insurance_rules_palette
- oracle:mysql
- oracle:rapid_planning
- oracle:retail_assortment_planning
- oracle:retail_back_office
- oracle:retail_bulk_data_integration
- oracle:retail_central_office
- oracle:retail_financial_integration
- oracle:retail_integration_bus
- oracle:retail_order_broker
- oracle:retail_point-of-service
- oracle:retail_predictive_application_server
- oracle:retail_returns_management
- oracle:retail_service_backbone
- oracle:siebel_engineering_-_installer_\&_deployment
- oracle:weblogic_server
- vmware:spring_framework
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8wx2-9q48-vm9r | Maven | org.springframework:spring-webmvc | >=5.2.0.RELEASE <5.2.3.RELEASE | 5.2.3.RELEASE |
| GHSA-8wx2-9q48-vm9r | Maven | org.springframework:spring-webmvc | >=5.1.0.RELEASE <5.1.13.RELEASE | 5.1.13.RELEASE |
| GHSA-8wx2-9q48-vm9r | Maven | org.springframework:spring-webmvc | >=5.0.0.RELEASE <5.0.16.RELEASE | 5.0.16.RELEASE |
| GHSA-8wx2-9q48-vm9r | Maven | org.springframework:spring-webflux | >=5.2.0.RELEASE <5.2.3.RELEASE | 5.2.3.RELEASE |
| GHSA-8wx2-9q48-vm9r | Maven | org.springframework:spring-webflux | >=5.1.0.RELEASE <5.1.13.RELEASE | 5.1.13.RELEASE |
| GHSA-8wx2-9q48-vm9r | Maven | org.springframework:spring-webflux | >=5.0.0.RELEASE <5.0.16.RELEASE | 5.0.16.RELEASE |
References
- https://lists.apache.org/thread.html/r028977b9b9d44a89823639aa3296fb0f0cfdd76b4450df89d3c4fbbf%40%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r0f2d0ae1bad2edb3d4a863d77f3097b5e88cfbdae7b809f4f42d6aad%40%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r0f3530f7cb510036e497532ffc4e0bd0b882940448cf4e233994b08b%40%3Ccommits.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r1accbd4f31ad2f40e1661d70a4510a584eb3efd1e32e8660ccf46676%40%3Ccommits.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r1bc5d673c01cfbb8e4a91914e9748ead3e5f56b61bca54d314c0419b%40%3Cissues.karaf.apache.org%3E