NetSight
IP …
high7.5

CVE-2020-5398

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a refle…

Impact

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Affected products

VendorProductAffected versions
VmwareSpring Framework
from 5.0.0 before 5.0.16
from 5.1.0 before 5.1.13
from 5.2.0 before 5.2.3
OracleApplication Testing Suite
Version 13.3.0.1
OracleCommunications Billing And Revenue Management Elastic Charging Engine
Versions 11.3, 12.0
OracleCommunications Cloud Native Core Policy
Version 1.5.0
OracleCommunications Diameter Signaling Router
from 8.0.0 through 8.2.2
OracleCommunications Element Manager
Versions 8.1.1, 8.2.0, 8.2.1
OracleCommunications Policy Management
Version 12.5.0
OracleCommunications Session Report Manager
Versions 8.1.1, 8.2.0, 8.2.1
OracleCommunications Session Route Manager
Versions 8.1.1, 8.2.0, 8.2.1
OracleEnterprise Manager Base Platform
Version 13.2.1.0
OracleFinancial Services Regulatory Reporting With Agilereporter
Version 8.0.9.2.0
OracleFlexcube Private Banking
Versions 12.0.0, 12.1.0

Weakness classification

CWE-79CWE-494

References