Log in Start free

Vulnerability · Published Jan 16, 2020 · Assigned by pivotal

CVE-2020-5398RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

High 8.0

In plain English

A high-severity cross-site scripting in Spring Framework from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 88.3% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)8.0High
Exploit odds (30 days)88.3%top 0.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.springframework:spring-webflux5.2.3.RELEASEGHSA-8wx2-9q48-vm9r
Mavenorg.springframework:spring-webflux5.1.13.RELEASEGHSA-8wx2-9q48-vm9r
Mavenorg.springframework:spring-webflux5.0.16.RELEASEGHSA-8wx2-9q48-vm9r
Mavenorg.springframework:spring-webmvc5.2.3.RELEASEGHSA-8wx2-9q48-vm9r
Mavenorg.springframework:spring-webmvc5.1.13.RELEASEGHSA-8wx2-9q48-vm9r
Mavenorg.springframework:spring-webmvc5.0.16.RELEASEGHSA-8wx2-9q48-vm9r
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2020-5398
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2020-5398
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2020-5398

Affected products (as reported)

VendorProductVersions
Spring Spring Framework 5.0 – before v5.0.16.RELEASE5.1 – before v5.1.13.RELEASE5.2 – before v5.2.3.RELEASE

Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

References