NetSight
IP …
medium6.5

CVE-2020-5421

Improper Input Validation in Spring Framework

Impact

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.springframework:spring-framework-bom>= 5.2.0, <= 5.2.85.2.9

Affected products

VendorProductAffected versions
VmwareSpring Framework
before 4.3.29
from 5.0.0 before 5.0.19
from 5.1.0 before 5.1.18
from 5.2.0 before 5.2.9
OracleCommerce Guided Search
Version 11.3.2
OracleCommunications Brm
Versions 11.3.0.9, 12.0.0.3
OracleCommunications Design Studio
Versions 7.3.4, 7.3.5, 7.4.0
OracleCommunications Session Report Manager
from 8.2.1 through 8.2.2.1
OracleCommunications Unified Inventory Management
Versions 7.3.4, 7.3.5
OracleEndeca Information Discovery Integrator
Version 3.2.0
OracleEnterprise Data Quality
Versions 12.2.1.3.0, 12.2.1.4.0
OracleFinancial Services Analytical Applications Infrastructure
from 8.0.6 through 8.1.0
OracleFlexcube Private Banking
Versions 12.0.0, 12.1.0
OracleFusion Middleware
Versions 12.2.1.3.0, 12.2.1.4.0
OracleGoldengate Application Adapters
Version 19.1.0.0.0

Weakness classification

CWE-35

References