Search/CVE-2020-5421
● CVE — Medium

CVE-2020-5421

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

View graph Watch Export
CVSS v3.1
6.5 MEDIUM
EPSS
10.7%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredLOW
User InteractionREQUIRED
ScopeCHANGED
ConfidentialityLOW
IntegrityHIGH
AvailabilityNONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
Connections
25 relationships
communications unified inventory management
source
financial services analytical applications infrastructure
source
fusion middleware
source
spring framework
source
goldengate application adapters
source
healthcare master person index
source
insurance rules palette
source
primavera gateway
source
retail integration bus
source
primavera p6 enterprise project portfolio management
source
flexcube private banking
source
endeca information discovery integrator
source
insurance policy administration
source
mysql enterprise monitor
source
retail assortment planning
source
communications design studio
source
communications session report manager
source
retail customer management and segmentation foundation
source
enterprise data quality
source
hyperion infrastructure technology
source
retail bulk data integration
source
retail financial integration
source
commerce guided search
source
communications brm
source
retail customer engagement
source
Timeline
disclosure → media coverage
Sep 19, 2020
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024
Public PoC (1)
github.com/pandaMingx/CVE-2020-5421
Unverified third-party code — review before executing.