CVE-2020-5398
RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
8.0 HighPublic exploitFix available
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
88.3%Up 60.6 points since Apr 14, 2021
What each source reports
CVE List Score used
RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
- Record
CVE-2020-5398- CVSS 3.0
- 8.0 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2020-0259
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
- Record
EUVD-2020-0259- CVSS 3.0
- 8.0 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8wx2-9q48-vm9r
RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
- Record
GHSA-8wx2-9q48-vm9r- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79, CWE-494
- Updated
- 2026-11-02
NVD
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
- Record
CVE-2020-5398- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.0 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS 2.0
- 7.6 High
AV:N/AC:H/Au:N/C:C/I:C/A:C - Weakness
- CWE-79, CWE-494
- Updated
- 2026-11-02
OSV
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
- Record
CVE-2020-5398- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-8wx2-9q48-vm9r
RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
- Record
GHSA-8wx2-9q48-vm9r- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-494, CWE-79
- Updated
- 2026-11-02
Show 10 moreShow less
OSVUBUNTU-CVE-2020-5398
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
- Record
UBUNTU-CVE-2020-5398- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.0 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1762906008 No score
TuxCare security update for org.springframework (13 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 13 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.1.
- Record
CLSA-2025-1762906008- Updated
- 2026-11-02
OSVCLSA-2026-1777855419 No score
TuxCare security update for org.springframework (5 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 5 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.2.
- Record
CLSA-2026-1777855419- Updated
- 2026-11-02
OSVCLSA-2026-1784769547 No score
TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 6 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1.
- Record
CLSA-2026-1784769547- Updated
- 2026-11-02
OSVCLSA-2026-1784769551 No score
TuxCare security update for org.springframework (9 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 9 CVEs. Fixed in 5.1.9.RELEASE-tuxcare.1.
- Record
CLSA-2026-1784769551- Updated
- 2026-11-02
OSVCLSA-2026-1785204448 No score
TuxCare security update for org.springframework (5 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 5 CVEs. Fixed in 5.0.13.RELEASE-tuxcare.1.
- Record
CLSA-2026-1785204448- Updated
- 2026-11-02
OSVCLSA-2026-1785959911 No score
TuxCare security update for org.springframework (5 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 5 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.3.
- Record
CLSA-2026-1785959911- Updated
- 2026-11-02
OSVCLSA-2026-1790970183 No score
TuxCare security update for org.springframework (29 CVEs)
TuxCare rebuilt 9 org.springframework packages to address 29 CVEs. Fixed in 5.1.3.RELEASE-tuxcare.1.
- Record
CLSA-2026-1790970183- Updated
- 2026-11-02
OSVCLSA-2026-1793897973 No score
TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 10 CVEs. Fixed in 5.1.8.RELEASE-tuxcare.2.
- Record
CLSA-2026-1793897973- Updated
- 2026-11-06
OSVCLSA-2026-1793900222 No score
TuxCare security update for org.springframework (8 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 8 CVEs. Fixed in 5.1.7.RELEASE-tuxcare.3.
- Record
CLSA-2026-1793900222- Updated
- 2026-11-06
Affected products
- spring framework
- vmware spring framework
- netapp data availability services
- netapp snapcenter
- oracle application testing suite
- oracle communications billing and revenue management elastic charging engine
- oracle communications cloud native core policy
- oracle communications diameter signaling router
- oracle communications element manager
- oracle communications policy management
- oracle communications session report manager
- oracle communications session route manager
Show 22 moreShow less
- oracle enterprise manager base platform
- oracle financial services regulatory reporting with agilereporter
- oracle flexcube private banking
- oracle healthcare master person index
- oracle insurance calculation engine
- oracle insurance policy administration j2ee
- oracle insurance rules palette
- oracle mysql
- oracle rapid planning
- oracle retail assortment planning
- oracle retail back office
- oracle retail bulk data integration
- oracle retail central office
- oracle retail financial integration
- oracle retail integration bus
- oracle retail order broker
- oracle retail point-of-service
- oracle retail predictive application server
- oracle retail returns management
- oracle retail service backbone
- oracle siebel engineering - installer \& deployment
- oracle weblogic server
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webmvcMaven |
5.2.0.RELEASE up to 5.2.3.RELEASE | 5.2.3.RELEASE |
org.springframework:spring-webmvcMaven |
5.1.0.RELEASE up to 5.1.13.RELEASE | 5.1.13.RELEASE |
org.springframework:spring-webmvcMaven |
5.0.0.RELEASE up to 5.0.16.RELEASE | 5.0.16.RELEASE |
org.springframework:spring-webfluxMaven |
5.2.0.RELEASE up to 5.2.3.RELEASE | 5.2.3.RELEASE |
org.springframework:spring-webfluxMaven |
5.1.0.RELEASE up to 5.1.13.RELEASE | 5.1.13.RELEASE |
org.springframework:spring-webfluxMaven |
5.0.0.RELEASE up to 5.0.16.RELEASE | 5.0.16.RELEASE |
org.springframework:springTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
Show 69 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 5 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.2, plus listed versions 5.1.5.RELEASE-tuxcare.1 |
5.1.5.RELEASE-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 5 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.2, plus listed versions 5.1.5.RELEASE-tuxcare.1 |
5.1.5.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 5 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.2, plus listed versions 5.1.5.RELEASE-tuxcare.1 |
5.1.5.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 5 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.2, plus listed versions 5.1.5.RELEASE-tuxcare.1 |
5.1.5.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 5 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.2, plus listed versions 5.1.5.RELEASE-tuxcare.1 |
5.1.5.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 6 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 6 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 6 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 6 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 6 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 6 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 9 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 9 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 9 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 9 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 9 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 9 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 9 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 5 CVEs |
5.0.13.RELEASE up to 5.0.13.RELEASE-tuxcare.1 | 5.0.13.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 5 CVEs |
5.0.13.RELEASE up to 5.0.13.RELEASE-tuxcare.1 | 5.0.13.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 5 CVEs |
5.0.13.RELEASE up to 5.0.13.RELEASE-tuxcare.1 | 5.0.13.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 5 CVEs |
5.0.13.RELEASE up to 5.0.13.RELEASE-tuxcare.1 | 5.0.13.RELEASE-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 5 CVEs |
5.0.13.RELEASE up to 5.0.13.RELEASE-tuxcare.1 | 5.0.13.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 5 CVEs |
5.0.13.RELEASE up to 5.0.13.RELEASE-tuxcare.1 | 5.0.13.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 5 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.3, plus listed versions 5.0.5.RELEASE-tuxcare.15.0.5.RELEASE-tuxcare.2 |
5.0.5.RELEASE-tuxcare.3 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 5 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.3, plus listed versions 5.0.5.RELEASE-tuxcare.15.0.5.RELEASE-tuxcare.2 |
5.0.5.RELEASE-tuxcare.3 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 5 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.3, plus listed versions 5.0.5.RELEASE-tuxcare.15.0.5.RELEASE-tuxcare.2 |
5.0.5.RELEASE-tuxcare.3 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 5 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.3, plus listed versions 5.0.5.RELEASE-tuxcare.15.0.5.RELEASE-tuxcare.2 |
5.0.5.RELEASE-tuxcare.3 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 5 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.3, plus listed versions 5.0.5.RELEASE-tuxcare.15.0.5.RELEASE-tuxcare.2 |
5.0.5.RELEASE-tuxcare.3 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 29 CVEs |
5.1.3.RELEASE up to 5.1.3.RELEASE-tuxcare.1 | 5.1.3.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 29 CVEs |
5.1.3.RELEASE up to 5.1.3.RELEASE-tuxcare.1 | 5.1.3.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 29 CVEs |
5.1.3.RELEASE up to 5.1.3.RELEASE-tuxcare.1 | 5.1.3.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 29 CVEs |
5.1.3.RELEASE up to 5.1.3.RELEASE-tuxcare.1 | 5.1.3.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 29 CVEs |
5.1.3.RELEASE up to 5.1.3.RELEASE-tuxcare.1 | 5.1.3.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 29 CVEs |
5.1.3.RELEASE up to 5.1.3.RELEASE-tuxcare.1 | 5.1.3.RELEASE-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 29 CVEs |
5.1.3.RELEASE up to 5.1.3.RELEASE-tuxcare.1 | 5.1.3.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 29 CVEs |
5.1.3.RELEASE up to 5.1.3.RELEASE-tuxcare.1 | 5.1.3.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 29 CVEs |
5.1.3.RELEASE up to 5.1.3.RELEASE-tuxcare.1 | 5.1.3.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 8 CVEs |
5.1.7.RELEASE up to 5.1.7.RELEASE-tuxcare.3, plus listed versions 5.1.7.RELEASE-tuxcare.15.1.7.RELEASE-tuxcare.2 |
5.1.7.RELEASE-tuxcare.3 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 8 CVEs |
5.1.7.RELEASE up to 5.1.7.RELEASE-tuxcare.3, plus listed versions 5.1.7.RELEASE-tuxcare.15.1.7.RELEASE-tuxcare.2 |
5.1.7.RELEASE-tuxcare.3 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 8 CVEs |
5.1.7.RELEASE up to 5.1.7.RELEASE-tuxcare.3, plus listed versions 5.1.7.RELEASE-tuxcare.15.1.7.RELEASE-tuxcare.2 |
5.1.7.RELEASE-tuxcare.3 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 8 CVEs |
5.1.7.RELEASE up to 5.1.7.RELEASE-tuxcare.3, plus listed versions 5.1.7.RELEASE-tuxcare.15.1.7.RELEASE-tuxcare.2 |
5.1.7.RELEASE-tuxcare.3 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 8 CVEs |
5.1.7.RELEASE up to 5.1.7.RELEASE-tuxcare.3, plus listed versions 5.1.7.RELEASE-tuxcare.15.1.7.RELEASE-tuxcare.2 |
5.1.7.RELEASE-tuxcare.3 |
org.springframework:spring-webmvcMaven |
5.2.0.RELEASE up to 5.2.3.RELEASE, plus listed versions 5.2.1.RELEASE5.2.2.RELEASE |
5.2.3.RELEASE |
org.springframework:spring-webmvcMaven |
5.1.0.RELEASE up to 5.1.13.RELEASE, plus listed versions 5.1.1.RELEASE5.1.10.RELEASE5.1.11.RELEASE5.1.12.RELEASE5.1.2.RELEASE Show 7 moreShow less5.1.3.RELEASE5.1.4.RELEASE5.1.5.RELEASE5.1.6.RELEASE5.1.7.RELEASE5.1.8.RELEASE5.1.9.RELEASE |
5.1.13.RELEASE |
org.springframework:spring-webmvcMaven |
5.0.0.RELEASE up to 5.0.16.RELEASE, plus listed versions 5.0.1.RELEASE5.0.10.RELEASE5.0.11.RELEASE5.0.12.RELEASE5.0.13.RELEASE Show 10 moreShow less5.0.14.RELEASE5.0.15.RELEASE5.0.2.RELEASE5.0.3.RELEASE5.0.4.RELEASE5.0.5.RELEASE5.0.6.RELEASE5.0.7.RELEASE5.0.8.RELEASE5.0.9.RELEASE |
5.0.16.RELEASE |
org.springframework:spring-webfluxMaven |
5.2.0.RELEASE up to 5.2.3.RELEASE, plus listed versions 5.2.1.RELEASE5.2.2.RELEASE |
5.2.3.RELEASE |
org.springframework:spring-webfluxMaven |
5.1.0.RELEASE up to 5.1.13.RELEASE, plus listed versions 5.1.1.RELEASE5.1.10.RELEASE5.1.11.RELEASE5.1.12.RELEASE5.1.2.RELEASE Show 7 moreShow less5.1.3.RELEASE5.1.4.RELEASE5.1.5.RELEASE5.1.6.RELEASE5.1.7.RELEASE5.1.8.RELEASE5.1.9.RELEASE |
5.1.13.RELEASE |
org.springframework:spring-webfluxMaven |
5.0.0.RELEASE up to 5.0.16.RELEASE, plus listed versions 5.0.1.RELEASE5.0.10.RELEASE5.0.11.RELEASE5.0.12.RELEASE5.0.13.RELEASE Show 10 moreShow less5.0.14.RELEASE5.0.15.RELEASE5.0.2.RELEASE5.0.3.RELEASE5.0.4.RELEASE5.0.5.RELEASE5.0.6.RELEASE5.0.7.RELEASE5.0.8.RELEASE5.0.9.RELEASE |
5.0.16.RELEASE |
libspring-javaUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.0.6.RELEASE-73.0.6.RELEASE-83.0.6.RELEASE-93.0.6.RELEASE-103.0.6.RELEASE-11 Show 4 moreShow less3.0.6.RELEASE-123.0.6.RELEASE-133.0.6.RELEASE-13ubuntu0.1~esm13.0.6.RELEASE-13ubuntu0.1~esm2 |
None known |
libspring-javaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.2.13-33.2.13-43.2.13-53.2.13-5ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.3.11-14.3.12-14.3.13-24.3.14-14.3.22-1~18.044.3.22-1~18.04.1~esm1 |
None known |
libspring-javaUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.3.22-44.3.22-4ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 4.3.30-14.3.30-1ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 4.3.30-24.3.30-2ubuntu0.24.04.1~esm1 |
None known |
libspring-javaUbuntu:25.10 |
All versions, plus listed versions 4.3.30-2ubuntu14.3.30-3ubuntu1 |
None known |
libspring-javaUbuntu:26.10 |
All versions, plus listed versions 4.3.30-3ubuntu1 |
None known |
libspring-javaUbuntu:26.04:LTS |
All versions, plus listed versions 4.3.30-3ubuntu1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | motikan2010/CVE-2020-5398 | 2020-01-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-5398 is a high vulnerability (CVSS 8.0) in Spring Framework, published January 16, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 88.3%, the 99th percentile. Fixed in org.springframework:spring-webmvc 5.2.3.RELEASE.
References
lists.apache.org/thread.html/rf8dc72b974ee74f17bce661ea7d124e733a1f4c4f236354ac0cf48e8%40%3Ccommits.camel.apache.org%3E
Show 78 moreShow less
oracle.com/security-alerts/cpuapr2020.html
pivotal.io/security/cve-2020-5398
security.netapp.com/advisory/ntap-20210917-0006
nvd.nist.gov/vuln/detail/CVE-2020-5398
github.com/spring-projects/spring-framework/commit/41f40c6c229d3b4f768718f1ec229d8f0ad76d76
ubuntu.com/security/CVE-2020-5398
cve.org/CVERecord?id=CVE-2020-5398