CVE-2020-5397 Spring Framework
| Affected software | Spring Framework |
|---|---|
| Severity | 5.3 Medium CVSS 3.1 3 scores |
| Fixed in | 5.2.3 |
| Weakness | Cross-site request forgery (CWE-352) |
| Published | 17 Jan 2020 |
| Updated | 13 Nov 2026 |
Description
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 6 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 2.6% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full CSRF
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR CSRF rule (synchronized-tokens), CSRF Same Origin rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: CSRF rule (synchronized-tokens), CSRF Same Origin rule
- The exploit: https://bugzilla.mozilla.org/show_bug.cgi?id=1019603
How to mitigate CVE-2020-5397
Upgrade Spring Framework to 5.2.3 or later. Until you can, Waratek RASP blocks exploitation with its CSRF rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
5.3 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
3 metrics
CVSS
5.3 MEDIUM v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
NVD | Primary | published |
| CVSS 3.0 | 5.3 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
security@pivotal.io | Secondary | |
| CVSS 2.0 | 2.6 | none | AV:N/AC:H/Au:N/C:N/I:P/A:N |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.springframework:spring-webmvc |
5.2.0 | 5.2.3 |
unbounded |
org.springframework:spring-webflux |
5.2.0 | 5.2.3 |
unbounded |
Products and versions
29 products, 54 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | oracle | application testing suite | generic | 13.3.0.1 |
| nvd | oracle | communications brm - elastic charging engine | generic | 11.3 · 12.0 |
| nvd | oracle | communications diameter signaling router | generic | ≥ 8.0.0 and ≤ 8.2.2 |
| nvd | oracle | communications element manager | generic | 8.1.1 · 8.2.0 · 8.2.1 |
| nvd | oracle | communications policy management | generic | 12.5.0 |
| nvd | oracle | communications session route manager | generic | 8.1.1 · 8.2.0 · 8.2.1 |
| nvd | oracle | enterprise manager base platform | generic | 13.2.1.0 |
| nvd | oracle | financial services regulatory reporting with agilereporter | generic | 8.0.9.2.0 |
| nvd | oracle | flexcube private banking | generic | 12.0.0 · 12.1.0 |
| nvd | oracle | healthcare master person index | generic | 4.0.2 |
| nvd | oracle | insurance calculation engine | generic | ≥ 11.0.0 and ≤ 11.3.1 |
| nvd | oracle | insurance policy administration j2ee | generic | 10.2.0 · 10.2.4 · 11.0.2 · 11.1.0 · 11.2.0 |
| nvd | oracle | insurance rules palette | generic | 10.2.0 · 10.2.4 · 11.0.2 · 11.1.0 · 11.2.0 |
| nvd | oracle | mysql enterprise monitor | generic | ≥ 4.0.0 and ≤ 4.0.12 · ≥ 8.0.0 and ≤ 8.0.20 |
| nvd | oracle | rapid planning | generic | 12.1 · 12.2 |
| nvd | oracle | retail assortment planning | generic | 15.0 · 16.0 |
| nvd | oracle | retail back office | generic | 14.1 |
| nvd | oracle | retail central office | generic | 14.1 |
| nvd | oracle | retail financial integration | generic | 15.0 · 16.0 |
| nvd | oracle | retail integration bus | generic | 15.0.3 · 16.0.3 |
| nvd | oracle | retail order broker | generic | 15.0 · 16.0 |
| nvd | oracle | retail point-of-service | generic | 14.1 |
| nvd | oracle | retail predictive application server | generic | 14.0.3 · 14.1.3 · 15.0.3.0 · 16.0.3.0 |
| nvd | oracle | retail returns management | generic | 14.1 |
| nvd | oracle | retail service backbone | generic | 15.0 · 16.0 |
| nvd | oracle | weblogic server | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| osv | org.springframework | spring-webflux | generic | ≥ 5.2.0 and ＜ 5.2.3 |
| osv | org.springframework | spring-webmvc | generic | ≥ 5.2.0 and ＜ 5.2.3 |
| nvd | vmware | spring framework | generic | ≥ 5.2.0 and ＜ 5.2.3 |
References
Timeline
Timeline
| Published | 2020-01-17 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |