Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2020-5421

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

CVSS v3:

  • Severity: Medium
  • Score: 6.5
  • AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

CVSS v2:

  • Severity: Low
  • Score: 3.6
  • AV:N/AC:H/Au:S/C:P/I:P/A:N

CWEs:

Software From Fixed in
vmware / spring_framework 5.1.0 5.1.18
vmware / spring_framework 5.2.0 5.2.9
vmware / spring_framework 5.0.0 5.0.19
vmware / spring_framework - 4.3.29
oracle / flexcube_private_banking 12.1.0 12.1.0.x
oracle / flexcube_private_banking 12.0.0 12.0.0.x
oracle / weblogic_server 12.1.3.0.0 12.1.3.0.0.x
oracle / insurance_rules_palette 10.2.0 10.2.0.x
oracle / weblogic_server 10.3.6.0.0 10.3.6.0.0.x
oracle / weblogic_server 12.2.1.3.0 12.2.1.3.0.x
oracle / endeca_information_discovery_integrator 3.2.0 3.2.0.x
oracle / retail_predictive_application_server 14.1 14.1.x
oracle / retail_order_broker 15.0 15.0.x
oracle / retail_order_broker 16.0 16.0.x
oracle / retail_integration_bus 14.1.3 14.1.3.x
oracle / retail_returns_management 14.1 14.1.x
oracle / insurance_policy_administration 10.2 10.2.x
oracle / enterprise_data_quality 12.2.1.3.0 12.2.1.3.0.x
oracle / communications_unified_inventory_management 7.3.4 7.3.4.x
oracle / communications_unified_inventory_management 7.3.5 7.3.5.x
oracle / retail_invoice_matching 14.0 14.0.x
oracle / retail_invoice_matching 14.1 14.1.x
oracle / fusion_middleware 12.2.1.3.0 12.2.1.3.0.x
oracle / weblogic_server 12.2.1.4.0 12.2.1.4.0.x
oracle / fusion_middleware 12.2.1.4.0 12.2.1.4.0.x
oracle / financial_services_analytical_applications_infrastructure 8.0.6 8.1.0.x
oracle / weblogic_server 14.1.1.0.0 14.1.1.0.0.x
oracle / hyperion_infrastructure_technology 11.1.2.4 11.1.2.4.x
oracle / retail_bulk_data_integration 16.0.3.0 16.0.3.0.x
oracle / retail_assortment_planning 16.0.3.0 16.0.3.0.x
oracle / retail_merchandising_system 16.0.3 16.0.3.x
oracle / goldengate_application_adapters 19.1.0.0.0 19.1.0.0.0.x
oracle / primavera_gateway 16.2.0 16.2.11.x
oracle / retail_service_backbone 15.0.3 15.0.3.x
oracle / retail_service_backbone 16.0.3 16.0.3.x
oracle / retail_financial_integration 15.0.3 15.0.3.x
oracle / retail_financial_integration 16.0.3 16.0.3.x
oracle / retail_financial_integration 14.1.3 14.1.3.x
oracle / retail_service_backbone 14.1.3 14.1.3.x
oracle / retail_integration_bus 15.0.3 15.0.3.x
oracle / primavera_gateway 17.12.0 17.12.9.x
oracle / retail_integration_bus 16.0.3 16.0.3.x
oracle / insurance_rules_palette 10.2.4 10.2.4.x
oracle / insurance_rules_palette 11.0.2 11.0.2.x
oracle / commerce_guided_search 11.3.2 11.3.2.x
oracle / retail_xstore_point_of_service 16.0.6 16.0.6.x
oracle / retail_xstore_point_of_service 17.0.4 17.0.4.x
oracle / retail_xstore_point_of_service 18.0.3 18.0.3.x
oracle / retail_xstore_point_of_service 19.0.2 19.0.2.x
oracle / insurance_rules_palette 11.1.0 11.3.0.x
oracle / insurance_policy_administration 11.1.0 11.3.0.x
oracle / insurance_policy_administration 11.0.2 11.0.2.x
oracle / primavera_gateway 19.12.0 19.12.10.x
oracle / retail_xstore_point_of_service 15.0.4 15.0.4.x
oracle / mysql_enterprise_monitor - 8.0.22.x
oracle / mysql_enterprise_monitor 8.0.23 8.0.23.x
oracle / insurance_policy_administration 10.2.4 10.2.4.x
oracle / healthcare_master_person_index 4.0.2.5 4.0.2.5.x
oracle / primavera_p6_enterprise_project_portfolio_management 16.1.0 16.2.20.x
oracle / primavera_p6_enterprise_project_portfolio_management 17.1.0 17.12.19.x
oracle / primavera_p6_enterprise_project_portfolio_management 18.1.0 18.8.21.x
oracle / primavera_p6_enterprise_project_portfolio_management 19.12.0 19.12.10.x
oracle / primavera_gateway 18.8.0 18.8.10.x
oracle / communications_session_report_manager 8.2.1 8.2.2.1.x
oracle / communications_brm 12.0.0.3 12.0.0.3.x
oracle / communications_brm 11.3.0.9 11.3.0.9.x
oracle / storagetek_tape_analytics_sw_tool 2.3 2.3.x
oracle / retail_customer_engagement 16.0 19.0.x
oracle / retail_customer_management_and_segmentation_foundation 16.0 19.0.x
oracle / enterprise_data_quality 12.2.1.4.0 12.2.1.4.0.x
oracle / communications_design_studio 7.3.4 7.3.4.x
oracle / communications_design_studio 7.3.5 7.3.5.x
oracle / communications_design_studio 7.4.0 7.4.0.x
oracle / storagetek_acsls 8.5.1 8.5.1.x
org.springframework / spring-framework-bom 5.2.0 5.2.9
org.springframework / spring-framework-bom 5.1.0 5.1.18
org.springframework / spring-framework-bom 5.0.0 5.0.19
org.springframework / spring-framework-bom 4.3.0 4.3.29