CVE-2020-5398 Spring Framework
| Affected software | Spring Framework |
|---|---|
| Severity | 7.5 High CVSS 3.1 3 scores |
| Fixed in | 5.2.3.RELEASE, 5.1.13.RELEASE, 5.0.16.RELEASE |
| Weakness | Cross-site scripting (CWE-79) |
| Published | 17 Jan 2020 |
| Updated | 8 Oct 2026 |
Description
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
CWE-494
Exploitation status
Proof of concept only
A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 1 indexed Published artifacts you can open, in GitHub PoC; first seen 2020-01-17.
- EPSS 88% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | CVE-2020-5398 - RFD(Reflected File Download) Attack for Spring MVC | 84 | 2020-01-17 |
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
3 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.0 | 8.0 | HIGH | CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
security@pivotal.io | Secondary | |
| CVSS 2.0 | 7.6 | none | AV:N/AC:H/Au:N/C:C/I:C/A:C |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Communications / VNF Manager (Spring Framework) (12.5.0) Oracle Insurance Applications / Architecture (Spring Framework) (11.0.0 - 11.3.1) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle Communications / Configuration (Spring Framework) (1.5.0) Oracle Retail Applications / Main Dashboard (Spring Framework) (14.1) Oracle Retail Applications / Pricing (Spring Framework) (14.1) Oracle Retail Applications / Queue Management (Spring Framework) (14.1) Oracle Retail Applications / Transaction Tracker (Spring Framework) (14.1) |
| Oracle Critical Patch Update April 2021 ↗ | CPU | 2021-Q2 | Oracle Siebel CRM / Siebel Approval Manager (Spring Framework) (21.1 and prior) |
| Oracle Critical Patch Update January 2021 ↗ | CPU | 2021-Q1 | Oracle Retail Applications / BDI Job Scheduler (Spring Framework) (16.0.3) |
| Oracle Critical Patch Update October 2020 ↗ | CPU | 2020-Q4 | Oracle Communications / IDIH (Spring Framework) (IDIH: 8.0.0-8.2.2) Oracle Enterprise Manager / Connector Framework (Spring Framework) (13.2.1.0) Oracle Enterprise Manager / Load Testing for Web Apps (Spring Framework) (13.3.0.1) Oracle Financial Services Applications / Core (Spring Framework) (12.0.0, 12.1.0) Oracle Financial Services Applications / Core (Spring Framework) (8.0.9.2.0) Oracle Insurance Applications / Admin Console (Spring Framework) (11.2.2.0) |
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle Communications Applications / Core (Spring Framework) (8.1.1, 8.2.0, 8.2.1) Oracle Communications Applications / Core (Spring Framework) (8.1.1, 8.2.0, 8.2.1) Oracle Communications Applications / Core (Spring Framework) (8.1.1, 8.2.0, 8.2.1) Oracle Communications Applications / Orchestration (Spring Framework) (11.3, 12.0) Oracle Fusion Middleware / Sample apps (Spring Framework) (12.2.1.3.0, 12.2.1.4.0) Oracle Health Sciences Applications / Master Data Management (Spring Framework) (4.0.2) Oracle Insurance Applications / Architecture (Spring Framework) (10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0) Oracle Insurance Applications / Architecture (Spring Framework) (10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0) Oracle MySQL / Monitoring: General (Spring Framework) (4.0.12 and prior, 8.0.20 and prior) Oracle Retail Applications / Application Core (Spring Framework) (15.0, 16.0) Oracle Retail Applications / PeopleSoft Integration (Spring Framework) (15.0, 16.0) Oracle Retail Applications / RIB Kernal (Spring Framework) (15.0.3, 16.0.3) Oracle Retail Applications / RPAS Server (Spring Framework) (14.0.3, 14.1.3, 15.0.3, 16.0.3) Oracle Retail Applications / RSB Installation (Spring Framework) (15.0, 16.0) Oracle Supply Chain / Installation (Spring Framework) (12.1, 12.2) |
| Oracle Critical Patch Update April 2020 ↗ | CPU | 2020-Q2 | Oracle Retail Applications / System Administration (Spring Framework) (15.0, 16.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Configuration (Spring Framework) | 1.5.0 | 1.5.0 |
| Oracle Communications | IDIH (Spring Framework) | IDIH: 8.0.0-8.2.2 | |
| Oracle Communications | VNF Manager (Spring Framework) | 12.5.0 | 12.5.0 |
| Oracle Communications Applications | Core (Spring Framework) | 8.1.1, 8.2.0, 8.2.1 | 8.1.1 · 8.2.0 · 8.2.1 |
| Oracle Communications Applications | Orchestration (Spring Framework) | 11.3, 12.0 | 11.3 · 12.0 |
| Oracle Enterprise Manager | Connector Framework (Spring Framework) | 13.2.1.0 | 13.2.1.0 |
| Oracle Enterprise Manager | Load Testing for Web Apps (Spring Framework) | 13.3.0.1 | 13.3.0.1 |
| Oracle Financial Services Applications | Core (Spring Framework) | 8.0.9.2.0 | 8.0.9.2.0 · 12.0.0 · 12.1.0 |
| Oracle Fusion Middleware | Sample apps (Spring Framework) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Health Sciences Applications | Master Data Management (Spring Framework) | 4.0.2 | 4.0.2 |
| Oracle Insurance Applications | Admin Console (Spring Framework) | 11.2.2.0 | 11.2.2.0 |
| Oracle Insurance Applications | Architecture (Spring Framework) | 11.0.0 - 11.3.1 | 10.2.0 · 10.2.4 · 11.0.2 · 11.1.0 · 11.2.0 |
| Oracle MySQL | Monitoring: General (Spring Framework) | 4.0.12 and prior, 8.0.20 and prior | |
| Oracle Retail Applications | Application Core (Spring Framework) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Retail Applications | BDI Job Scheduler (Spring Framework) | 16.0.3 | 16.0.3 |
| Oracle Retail Applications | Main Dashboard (Spring Framework) | 14.1 | 14.1 |
| Oracle Retail Applications | PeopleSoft Integration (Spring Framework) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Retail Applications | Pricing (Spring Framework) | 14.1 | 14.1 |
| Oracle Retail Applications | Queue Management (Spring Framework) | 14.1 | 14.1 |
| Oracle Retail Applications | RIB Kernal (Spring Framework) | 15.0.3, 16.0.3 | 15.0.3 · 16.0.3 |
| Oracle Retail Applications | RPAS Server (Spring Framework) | 14.0.3, 14.1.3, 15.0.3, 16.0.3 | 14.0.3 · 14.1.3 · 15.0.3 · 16.0.3 |
| Oracle Retail Applications | RSB Installation (Spring Framework) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Retail Applications | System Administration (Spring Framework) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Retail Applications | Transaction Tracker (Spring Framework) | 14.1 | 14.1 |
| Oracle Siebel CRM | Siebel Approval Manager (Spring Framework) | 21.1 and prior | |
| Oracle Supply Chain | Installation (Spring Framework) | 12.1, 12.2 | 12.1 · 12.2 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.springframework:spring-webmvc |
5.2.0.RELEASE | 5.2.3.RELEASE |
unbounded |
org.springframework:spring-webmvc |
5.1.0.RELEASE | 5.1.13.RELEASE |
unbounded |
org.springframework:spring-webmvc |
5.0.0.RELEASE | 5.0.16.RELEASE |
unbounded |
org.springframework:spring-webflux |
5.2.0.RELEASE | 5.2.3.RELEASE |
unbounded |
org.springframework:spring-webflux |
5.1.0.RELEASE | 5.1.13.RELEASE |
unbounded |
org.springframework:spring-webflux |
5.0.0.RELEASE | 5.0.16.RELEASE |
unbounded |
Products and versions
35 products, 69 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | netapp | data availability services | generic | any version |
| nvd | netapp | snapcenter | generic | any version |
| nvd | oracle | application testing suite | generic | 13.3.0.1 |
| nvd | oracle | communications billing and revenue management elastic charging engine | generic | 11.3 · 12.0 |
| nvd | oracle | communications cloud native core policy | generic | 1.5.0 |
| nvd | oracle | communications diameter signaling router | generic | ≥ 8.0.0 and ≤ 8.2.2 |
| nvd | oracle | communications element manager | generic | 8.1.1 · 8.2.0 · 8.2.1 |
| nvd | oracle | communications policy management | generic | 12.5.0 |
| nvd | oracle | communications session report manager | generic | 8.1.1 · 8.2.0 · 8.2.1 |
| nvd | oracle | communications session route manager | generic | 8.1.1 · 8.2.0 · 8.2.1 |
| nvd | oracle | enterprise manager base platform | generic | 13.2.1.0 |
| nvd | oracle | financial services regulatory reporting with agilereporter | generic | 8.0.9.2.0 |
| nvd | oracle | flexcube private banking | generic | 12.0.0 · 12.1.0 |
| nvd | oracle | healthcare master person index | generic | 4.0.2 |
| nvd | oracle | insurance calculation engine | generic | ≥ 11.0.0 and ≤ 11.3.1 |
| nvd | oracle | insurance policy administration j2ee | generic | 10.2.0 · 10.2.4 · 11.0.2 · 11.1.0 · 11.2.0 · 11.2.2.0 |
| nvd | oracle | insurance rules palette | generic | 10.2.0 · 10.2.4 · 11.0.2 · 11.1.0 · 11.2.0 |
| nvd | oracle | mysql | generic | ≥ 4.0.0 and ≤ 4.0.12 · ≥ 8.0.0 and ≤ 8.0.20 |
| nvd | oracle | rapid planning | generic | 12.1 · 12.2 |
| nvd | oracle | retail assortment planning | generic | 15.0 · 16.0 |
| nvd | oracle | retail back office | generic | 14.1 |
| nvd | oracle | retail bulk data integration | generic | 16.0.3.0 |
| nvd | oracle | retail central office | generic | 14.1 |
| nvd | oracle | retail financial integration | generic | 15.0 · 16.0 |
| nvd | oracle | retail integration bus | generic | 15.0.3 · 16.0.3 |
| nvd | oracle | retail order broker | generic | 15.0 · 16.0 |
| nvd | oracle | retail point-of-service | generic | 14.1 |
| nvd | oracle | retail predictive application server | generic | 14.0.3 · 14.1.3.0 · 15.0.3 · 16.0.3.0 |
| nvd | oracle | retail returns management | generic | 14.1 |
| nvd | oracle | retail service backbone | generic | 15.0 · 16.0 |
| nvd | oracle | siebel engineering - installer \& deployment | generic | ≤ 2.1.1 |
| nvd | oracle | weblogic server | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| osv | org.springframework | spring-webflux | generic | ≥ 5.0.0 and ＜ 5.0.16 · ≥ 5.1.0 and ＜ 5.1.13 · ≥ 5.2.0 and ＜ 5.2.3 |
| osv | org.springframework | spring-webmvc | generic | ≥ 5.0.0 and ＜ 5.0.16 · ≥ 5.1.0 and ＜ 5.1.13 · ≥ 5.2.0 and ＜ 5.2.3 |
| nvd | vmware | spring framework | generic | ≥ 5.0.0 and ＜ 5.0.16 · ≥ 5.1.0 and ＜ 5.1.13 · ≥ 5.2.0 and ＜ 5.2.3 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** CONNECTOR FRAMEWORK (SPRING FRAMEWORK), IDIH (SPRING FRAMEWORK), TRANSACTION TRACKER (SPRING FRAMEWORK), NO AUTH REMOTE EXPLOIT, MAIN DASHBOARD (SPRING FRAMEWORK), PEOPLESOFT INTEGRATION (SPRING FRAMEWORK), SAMPLE APPS (SPRING FRAMEWORK), INSTALLATION (SPRING FRAMEWORK), PRICING (SPRING FRAMEWORK), MONITORING: GENERAL (SPRING FRAMEWORK), MASTER DATA MANAGEMENT (SPRING FRAMEWORK), HTTP, CONFIGURATION (SPRING FRAMEWORK), SYSTEM ADMINISTRATION (SPRING FRAMEWORK), CORE (SPRING FRAMEWORK), LOAD TESTING FOR WEB APPS (SPRING FRAMEWORK), ADMIN CONSOLE (SPRING FRAMEWORK), QUEUE MANAGEMENT (SPRING FRAMEWORK), APPLICATION CORE (SPRING FRAMEWORK), ORCHESTRATION (SPRING FRAMEWORK), BDI JOB SCHEDULER (SPRING FRAMEWORK), RPAS SERVER (SPRING FRAMEWORK), RIB KERNAL (SPRING FRAMEWORK), HTTPS, SIEBEL APPROVAL MANAGER (SPRING FRAMEWORK), ARCHITECTURE (SPRING FRAMEWORK), RSB INSTALLATION (SPRING FRAMEWORK), VNF MANAGER (SPRING FRAMEWORK) **Products:** ORACLE COMMUNICATIONS SESSION ROUTE MANAGER, ORACLE ENTERPRISE MANAGER, ORACLE RAPID PLANNING, ORACLE RETAIL ASSORTMENT PLANNING, ORACLE RETAIL POINT-OF-SERVICE, ORACLE RETAIL PREDICTIVE APPLICATION SERVER, ORACLE RETAIL RETURNS MANAGEMENT, SIEBEL ENGINEERING - INSTALLER & DEPLOYMENT, ORACLE RETAIL FINANCIAL INTEGRATION, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE MYSQL, ORACLE RETAIL BULK DATA INTEGRATION, ORACLE RETAIL APPLICATIONS, ORACLE RETAIL BACK OFFICE, ORACLE INSURANCE POLICY ADMINISTRATION J2EE, ORACLE APPLICATION TESTING SUITE, ORACLE SUPPLY CHAIN, ORACLE HEALTHCARE MASTER PERSON INDEX, ENTERPRISE MANAGER BASE PLATFORM, SPRINGFRAMEWORK, ORACLE COMMUNICATIONS SESSION REPORT MANAGER, ORACLE INSURANCE APPLICATIONS, ORACLE FLEXCUBE PRIVATE BANKING, ORACLE WEBLOGIC SERVER, ORACLE COMMUNICATIONS BRM - ELASTIC CHARGING ENGINE, ORACLE FINANCIAL SERVICES REGULATORY REPORTING WITH AGILEREPORTER, ORACLE COMMUNICATIONS DIAMETER SIGNALING ROUTER (DSR), MYSQL ENTERPRISE MONITOR, ORACLE COMMUNICATIONS ELEMENT MANAGER, ORACLE FUSION MIDDLEWARE, ORACLE SIEBEL CRM, ORACLE RETAIL INTEGRATION BUS, ORACLE RETAIL CENTRAL OFFICE, ORACLE COMMUNICATIONS, ORACLE RETAIL SERVICE BACKBONE, ORACLE RETAIL ORDER BROKER, ORACLE INSURANCE RULES PALETTE, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE HEALTH SCIENCES APPLICATIONS, ORACLE COMMUNICATIONS CLOUD NATIVE CORE POLICY, ORACLE COMMUNICATIONS POLICY MANAGEMENT, ORACLE INSURANCE CALCULATION ENGINE
References
Timeline
Timeline
| Published | 2020-01-17 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |