Log in Start free

Vulnerability · Published Sep 19, 2020 · Assigned by pivotal

CVE-2020-5421RFD Protection Bypass via jsessionid

High 8.7

In plain English

A high-severity security flaw in Spring Framework from Spring by VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.6% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)8.7High
Exploit odds (30 days)11.6%top 3.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-java4.3.30-1DEBIAN-CVE-2020-5421
Debian:13libspring-java4.3.30-1DEBIAN-CVE-2020-5421
Debian:14libspring-java4.3.30-1DEBIAN-CVE-2020-5421
Mavenorg.springframework:spring-framework-bom4.3.29GHSA-rv39-3qh7-9v7w
Mavenorg.springframework:spring-framework-bom5.2.9GHSA-rv39-3qh7-9v7w
Mavenorg.springframework:spring-framework-bom5.1.18GHSA-rv39-3qh7-9v7w
Mavenorg.springframework:spring-framework-bom5.0.19GHSA-rv39-3qh7-9v7w
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2020-5421
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2020-5421
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2020-5421

Affected products (as reported)

VendorProductVersions
Spring by VMware Spring Framework 4.3 – before 4.3.295.0 – before 5.0.195.1 – before 5.1.185.2 – before 5.2.9

References