Vulnetix
Try Vulnetix Request Demo
CVE-2020-5398 PUBLISHED

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

EPSS 90.18% · 99.6th percentile

Risk Scores

EPSS Score
90.18%
99.6th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:16.04:LTSlibspring-java3.2.13-3, 3.2.13-4, 3.2.13-5
Ubuntu:Pro:22.04:LTSlibspring-java4.3.30-1ubuntu0.1~esm1, 4.3.30-1, 0
Ubuntu:25.10libspring-java4.3.30-2ubuntu1, 0, 4.3.30-3ubuntu1
Ubuntu:Pro:14.04:LTSlibspring-java0, 3.0.6.RELEASE-7, 3.0.6.RELEASE-8
Ubuntu:Pro:18.04:LTSlibspring-java0, 4.3.22-1~18.04, 4.3.14-1
Ubuntu:Pro:24.04:LTSlibspring-java0, 4.3.30-2, 4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu:Pro:20.04:LTSlibspring-java0, 4.3.22-4, 4.3.22-4ubuntu0.1~esm1

Timeline

References

Open in Interactive Console →