RFD Protection Bypass via jsessionid
Priority MEDIUM 42CWE-35Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Partial Red Hat: 1 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.11564 96th percentileScored 2026-11-07
Fix Partial Spring Framework (Spring by VMware): 4.3.29, 5.0.19, 5.1.18 +1org.springframework:spring-framework-bom (Maven): 5.2.9, 5.1.18, 5.0.19 +1Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Spring Framework | 4.3 to before 4.3.29; 5.0 to before 5.0.19; 5.1 to before 5.1.18; 5.2 to before 5.2.9 | 4.3.29, 5.0.19, 5.1.18, 5.2.9 | Patch available | CNA |
| — | org.springframework:spring-framework-bom (Maven) | 5.2.0 to before 5.2.9 | 5.2.9 | Patch available | GHSA-rv39-3qh7-9v7w |
| — | org.springframework:spring-framework-bom (Maven) | 5.1.0 to before 5.1.18 | 5.1.18 | Patch available | GHSA-rv39-3qh7-9v7w |
| — | org.springframework:spring-framework-bom (Maven) | 5.0.0 to before 5.0.19 | 5.0.19 | Patch available | GHSA-rv39-3qh7-9v7w |
| — | org.springframework:spring-framework-bom (Maven) | before 4.3.29 | 4.3.29 | Patch available | GHSA-rv39-3qh7-9v7w |
- Spring Framework VendorVMware Affected 4.3 to before 4.3.29; 5.0 to before 5.0.19; 5.1 to before 5.1.18; 5.2 to before 5.2.9 Fixed in 4.3.29, 5.0.19, 5.1.18, 5.2.9 Patch available CNA
- org.springframework:spring-framework-bom (Maven) Vendor— Affected 5.2.0 to before 5.2.9 Fixed in 5.2.9 Patch available GHSA-rv39-3qh7-9v7w
- org.springframework:spring-framework-bom (Maven) Vendor— Affected 5.1.0 to before 5.1.18 Fixed in 5.1.18 Patch available GHSA-rv39-3qh7-9v7w
- org.springframework:spring-framework-bom (Maven) Vendor— Affected 5.0.0 to before 5.0.19 Fixed in 5.0.19 Patch available GHSA-rv39-3qh7-9v7w
- org.springframework:spring-framework-bom (Maven) Vendor— Affected before 4.3.29 Fixed in 4.3.29 Patch available GHSA-rv39-3qh7-9v7w
CPE configurations NVD · 68
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* | before 4.3.29; 5.0.0 to before 5.0.19; 5.1.0 to before 5.1.18; 5.2.0 to before 5.2.9 | Vulnerable | VMware |
| cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* | 11.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_brm:11.3.0.9:*:*:*:*:*:*:* | 11.3.0.9 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_brm:12.0.0.3:*:*:*:*:*:*:* | 12.0.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_design_studio:7.3.4:*:*:*:*:*:*:* | 7.3.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_design_studio:7.3.5:*:*:*:*:*:*:* | 7.3.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_design_studio:7.4.0:*:*:*:*:*:*:* | 7.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* | 8.2.1 – 8.2.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:* | 7.3.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:* | 7.3.5 | Vulnerable | Oracle |
- cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions before 4.3.29; 5.0.0 to before 5.0.19; 5.1.0 to before 5.1.18; 5.2.0 to before 5.2.9 Vulnerable ·VMware
- cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_brm:11.3.0.9:*:*:*:*:*:*:* Versions 11.3.0.9 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_brm:12.0.0.3:*:*:*:*:*:*:* Versions 12.0.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_design_studio:7.3.4:*:*:*:*:*:*:* Versions 7.3.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_design_studio:7.3.5:*:*:*:*:*:*:* Versions 7.3.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_design_studio:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.2.1 – 8.2.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:* Versions 7.3.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:* Versions 7.3.5 Vulnerable ·Oracle
Show 58 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:* | 3.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* | 8.0.6 – 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* | 12.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:fusion_middleware:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:fusion_middleware:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:* | 19.1.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:healthcare_master_person_index:4.0.2.5:*:*:*:*:*:*:* | 4.0.2.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:* | 11.1.2.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:* | 11.1.0 – 11.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:10.2:*:*:*:*:*:*:* | 10.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:10.2.4:*:*:*:*:*:*:* | 10.2.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:* | 11.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_rules_palette:*:*:*:*:*:*:*:* | 11.1.0 – 11.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_rules_palette:10.2.0:*:*:*:*:*:*:* | 10.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_rules_palette:10.2.4:*:*:*:*:*:*:* | 10.2.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:* | 11.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* | up to 8.0.22 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_enterprise_monitor:8.0.23:*:*:*:*:*:*:* | 8.0.23 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 16.2.0 – 16.2.11; 17.12.0 – 17.12.9; 18.8.0 – 18.8.10; 19.12.0 – 19.12.10 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* | 16.1.0 – 16.2.20; 17.1.0 – 17.12.19; 18.1.0 – 18.8.21; 19.12.0 – 19.12.10 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_assortment_planning:16.0.3.0:*:*:*:*:*:*:* | 16.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:* | 16.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_customer_engagement:*:*:*:*:*:*:*:* | 16.0 – 19.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:* | 16.0 – 19.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_financial_integration:14.1.3:*:*:*:*:*:*:* | 14.1.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_financial_integration:15.0.3:*:*:*:*:*:*:* | 15.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:* | 16.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:14.1.3:*:*:*:*:*:*:* | 14.1.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:15.0.3:*:*:*:*:*:*:* | 15.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:* | 16.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_invoice_matching:14.0:*:*:*:*:*:*:* | 14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_invoice_matching:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:* | 16.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_predictive_application_server:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* | 14.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_service_backbone:14.1.3:*:*:*:*:*:*:* | 14.1.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_service_backbone:15.0.3:*:*:*:*:*:*:* | 15.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_service_backbone:16.0.3:*:*:*:*:*:*:* | 16.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.4:*:*:*:*:*:*:* | 15.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* | 16.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* | 17.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* | 18.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* | 19.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* | 8.5.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:* | 2.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* | 10.3.6.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* | 12.1.3.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* | 14.1.1.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.6 – 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:fusion_middleware:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:fusion_middleware:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:* Versions 19.1.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:healthcare_master_person_index:4.0.2.5:*:*:*:*:*:*:* Versions 4.0.2.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:* Versions 11.1.2.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:* Versions 11.1.0 – 11.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:10.2.4:*:*:*:*:*:*:* Versions 10.2.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:* Versions 11.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_rules_palette:*:*:*:*:*:*:*:* Versions 11.1.0 – 11.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_rules_palette:10.2.0:*:*:*:*:*:*:* Versions 10.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_rules_palette:10.2.4:*:*:*:*:*:*:* Versions 10.2.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:* Versions 11.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.22 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_enterprise_monitor:8.0.23:*:*:*:*:*:*:* Versions 8.0.23 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 16.2.0 – 16.2.11; 17.12.0 – 17.12.9; 18.8.0 – 18.8.10; 19.12.0 – 19.12.10 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* Versions 16.1.0 – 16.2.20; 17.1.0 – 17.12.19; 18.1.0 – 18.8.21; 19.12.0 – 19.12.10 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_assortment_planning:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_customer_engagement:*:*:*:*:*:*:*:* Versions 16.0 – 19.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:* Versions 16.0 – 19.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_financial_integration:14.1.3:*:*:*:*:*:*:* Versions 14.1.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_financial_integration:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:14.1.3:*:*:*:*:*:*:* Versions 14.1.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_invoice_matching:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_invoice_matching:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_predictive_application_server:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_service_backbone:14.1.3:*:*:*:*:*:*:* Versions 14.1.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_service_backbone:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_service_backbone:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.4:*:*:*:*:*:*:* Versions 15.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:* Versions 16.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* Versions 8.5.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* Versions 10.3.6.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA Spring Framework (Spring by VMware) Fixed in 4.3.29, 5.0.19, 5.1.18, 5.2.9
- Fix · GHSA-rv39-3qh7-9v7w org.springframework:spring-framework-bom (Maven) Fixed in 5.2.9 Advisory →
- Fix · GHSA-rv39-3qh7-9v7w org.springframework:spring-framework-bom (Maven) Fixed in 5.1.18 Advisory →
- Fix · GHSA-rv39-3qh7-9v7w org.springframework:spring-framework-bom (Maven) Fixed in 5.0.19 Advisory →
- Fix · GHSA-rv39-3qh7-9v7w org.springframework:spring-framework-bom (Maven) Fixed in 4.3.29 Advisory →
Red Hat 1 advisory
- RHSA-2021:3140 Released 2021-08-11 · Red Hat rating ModerateRed Hat Fuse 7.9.0 release and security update
- Red Hat Fuse 7.9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7.9 | Fixed | RHSA-2021:3140 |
Not affected: 2 products
- Red Hat Storage 3
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5421
- 2026-10-03 Alias added: GHSA-rv39-3qh7-9v7w
- 2026-10-08 CISA SSVC decision points changed
References
Patch 5
Advisory 4
Other 33
- [ranger-dev] 20201007 Re: Review Request 72934: RANGER-3022: Upgrade Spring framework to version 4.3.29.RELEASE
- [ambari-issues] 20201013 [jira] [Created] (AMBARI-25571) Vulnerable Spring components in Ambari - CVE-2020-5398, CVE-2020-5421
- [ambari-dev] 20201019 [GitHub] [ambari] dlysnichenko opened a new pull request #3246: AMBARI-25571. Vulnerable Spring components in Ambari - CVE-2020-5398, CVE-2020-5421
- [ambari-dev] 20201019 [GitHub] [ambari] dlysnichenko merged pull request #3246: AMBARI-25571. Vulnerable Spring components in Ambari - CVE-2020-5398, CVE-2020-5421
- [ambari-commits] 20201019 [ambari] branch branch-2.7 updated: AMBARI-25571. Vulnerable Spring components in Ambari - CVE-2020-5398, CVE-2020-5421 (dlysnichenko) (#3246)
- [ambari-issues] 20201021 [jira] [Resolved] (AMBARI-25571) Vulnerable Spring components in Ambari - CVE-2020-5398, CVE-2020-5421
- [hive-dev] 20201022 [jira] [Created] (HIVE-24303) Upgrade spring framework to 4.3.29.RELEASE+ due to CVE-2020-5421
- [hive-issues] 20201022 [jira] [Assigned] (HIVE-24303) Upgrade spring framework to 4.3.29.RELEASE+ due to CVE-2020-5421
- [hive-issues] 20201022 [jira] [Updated] (HIVE-24303) Upgrade spring framework to 4.3.29.RELEASE+ due to CVE-2020-5421
- [pulsar-commits] 20201022 [GitHub] [pulsar] Ghatage opened a new pull request #8355: [Issue 8354][pulsar-io] Upgrade spring framework version to patch CVE-2020-5421
- [pulsar-commits] 20201023 [GitHub] [pulsar] Ghatage commented on pull request #8355: [Issue 8354][pulsar-io] Upgrade spring framework version to patch CVE-2020-5421
- [pulsar-commits] 20201026 [GitHub] [pulsar] wolfstudy commented on pull request #8355: [Issue 8354][pulsar-io] Upgrade spring framework version to patch CVE-2020-5421
- [pulsar-commits] 20201028 [GitHub] [pulsar] merlimat merged pull request #8355: [Issue 8354][pulsar-io] Upgrade spring framework version to patch CVE-2020-5421
- [ignite-user] 20201117 Query on CVE-2020-5421
- [ignite-user] 20201119 Re: Query on CVE-2020-5421
- [hive-issues] 20210107 [jira] [Resolved] (HIVE-24303) Upgrade spring framework to 4.3.29.RELEASE+ due to CVE-2020-5421
- https://security.netapp.com/advisory/ntap-20210513-0009
- https://lists.apache.org/thread.html/rf00d8f4101a1c1ea4de6ea1e09ddf7472cfd306745c90d6da87ae074@%3Cdev.hive.apache.org%3E
- https://lists.apache.org/thread.html/re014a49d77f038ba70e5e9934d400af6653e8c9ac110d32b1254127e@%3Cdev.ranger.apache.org%3E
- https://lists.apache.org/thread.html/rd462a8b0dfab4c15e67c0672cd3c211ecd0e4f018f824082ed54f665@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/rc9efaf6db98bee19db1bc911d0fa442287dac5cb229d4aaa08b6a13d@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/rb18ed999153ef0f0cb7af03efe0046c42c7242fd77fbd884a75ecfdc@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/raf7ca57033e537e4f9d7df7f192fa6968c1e49409b2348e08d807ccb@%3Cuser.ignite.apache.org%3E
- https://lists.apache.org/thread.html/ra889d95141059c6cbe77dd80249bb488ae53b274b5f3abad09d9511d@%3Cuser.ignite.apache.org%3E
- https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1@%3Cdev.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r918caad55dcc640a16753b00d8d6acb90b4e36de4b6156d0867246ec@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a@%3Cdev.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r7e6a213eea7f04fc6d9e3bd6eb8d68c4df92a22e956e95cb2c482865@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5@%3Cissues.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r503e64b43a57fd68229cac4a869d1a9a2eac9e75f8719cad3a840211@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r3589ed0d18edeb79028615080d5a0e8878856436bb91774a3196d9eb@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a@%3Cissues.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163@%3Ccommits.ambari.apache.org%3E
More VMware Spring Framework vulnerabilities
- TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
- TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
- TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
- TI-2018-01180 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
- TI-2016-09283 Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution… CVSS 3.1CRITICAL 9.8
- TI-2014-00050 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2020-5421 · CVE Program
- CVE-2020-5421 · NVD
- FIRST EPSS
- GHSA-rv39-3qh7-9v7w · GitHub Advisory Database · CC BY 4.0
- CVE-2020-5421 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences