CVE-2020-5421

HIGH8.7

Description

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

CVSS breakdown

CVSS 3.0

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected products

NetApp / OnCommand Insight
NetApp / SnapCenter
NetApp / snap_creator_framework
oracle / commerce_guided_search11.3.2 – 11.3.2
oracle / communications_brm11.3.0.9 – 11.3.0.9
oracle / communications_brm12.0.0.3 – 12.0.0.3
oracle / communications_design_studio7.3.5 – 7.3.5
oracle / communications_design_studio7.4.0 – 7.4.0
oracle / communications_design_studio7.3.4 – 7.3.4
oracle / communications_session_report_manager8.2.1 – 8.2.2.1
oracle / communications_unified_inventory_management7.3.4 – 7.3.4
oracle / communications_unified_inventory_management7.3.5 – 7.3.5
oracle / endeca_information_discovery_integrator3.2.0 – 3.2.0
oracle / enterprise_data_quality12.2.1.3.0 – 12.2.1.3.0
oracle / enterprise_data_quality12.2.1.4.0 – 12.2.1.4.0
oracle / financial_services_analytical_applications_infrastructure8.0.6 – 8.1.0
oracle / FLEXCUBE Private Banking12.1.0 – 12.1.0
oracle / FLEXCUBE Private Banking12.0.0 – 12.0.0
oracle / fusion_middleware12.2.1.3.0 – 12.2.1.3.0
oracle / fusion_middleware12.2.1.4.0 – 12.2.1.4.0
oracle / goldengate_application_adapters19.1.0.0.0 – 19.1.0.0.0
oracle / healthcare_master_person_index4.0.2.5 – 4.0.2.5
oracle / hyperion_infrastructure_technology11.1.2.4 – 11.1.2.4
oracle / insurance_policy_administration10.2 – 10.2
oracle / insurance_policy_administration11.0.2 – 11.0.2
oracle / insurance_policy_administration11.1.0 – 11.3.0
oracle / insurance_policy_administration10.2.4 – 10.2.4
oracle / insurance_rules_palette10.2.0 – 10.2.0
oracle / insurance_rules_palette11.0.2 – 11.0.2
oracle / insurance_rules_palette11.1.0 – 11.3.0
oracle / insurance_rules_palette10.2.4 – 10.2.4
oracle / MySQL Enterprise Monitor8.0.22
oracle / MySQL Enterprise Monitor8.0.23 – 8.0.23
oracle / primavera_gateway16.2.0 – 16.2.11
oracle / primavera_p6_enterprise_project_portfolio_management16.1.0 – 16.2.20
oracle / retail_assortment_planning16.0.3.0 – 16.0.3.0
oracle / retail_bulk_data_integration16.0.3.0 – 16.0.3.0
oracle / retail_customer_engagement16.0 – 19.0
oracle / retail_customer_management_and_segmentation_foundation16.0 – 19.0
oracle / retail_financial_integration16.0.3 – 16.0.3
oracle / retail_financial_integration15.0.3 – 15.0.3
oracle / retail_financial_integration14.1.3 – 14.1.3
oracle / retail_integration_bus14.1.3 – 14.1.3
oracle / retail_integration_bus16.0.3 – 16.0.3
oracle / retail_integration_bus15.0.3 – 15.0.3
oracle / retail_invoice_matching14.0 – 14.0
oracle / retail_invoice_matching14.1 – 14.1
oracle / retail_merchandising_system16.0.3 – 16.0.3
oracle / retail_order_broker16.0 – 16.0
oracle / retail_order_broker15.0 – 15.0
oracle / retail_predictive_application_server14.1 – 14.1
oracle / retail_returns_management14.1 – 14.1
oracle / retail_service_backbone14.1.3 – 14.1.3
oracle / retail_service_backbone16.0.3 – 16.0.3
oracle / retail_service_backbone15.0.3 – 15.0.3
oracle / retail_xstore_point_of_service19.0.2 – 19.0.2
oracle / retail_xstore_point_of_service17.0.4 – 17.0.4
oracle / retail_xstore_point_of_service18.0.3 – 18.0.3
oracle / retail_xstore_point_of_service15.0.4 – 15.0.4
oracle / retail_xstore_point_of_service16.0.6 – 16.0.6
oracle / storagetek_acsls8.5.1 – 8.5.1
oracle / storagetek_tape_analytics_sw_tool2.3 – 2.3
oracle / weblogic_server12.2.1.3.0 – 12.2.1.3.0
oracle / weblogic_server14.1.1.0.0 – 14.1.1.0.0
oracle / weblogic_server10.3.6.0.0 – 10.3.6.0.0
oracle / weblogic_server12.1.3.0.0 – 12.1.3.0.0
oracle / weblogic_server12.2.1.4.0 – 12.2.1.4.0
Spring by VMware / Spring Framework5.0 – 5.0.19
Spring by VMware / Spring Framework4.3 – 4.3.29
Spring by VMware / Spring Framework5.2 – 5.2.9
Spring by VMware / Spring Framework5.1 – 5.1.18
VMware / Spring Framework4.3.29

References

Updated 23m ago · 8 sources