VDB

CVE-2020-5421

CVE-2020-5421 PUBLISHED

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

EPSS 63.83% · 98.4th percentile

Risk Scores

EPSS Score
63.83%
98.4th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:24.04:LTSlibspring-java4.3.30-2ubuntu0.24.04.1~esm1, 0, 4.3.30-2
Ubuntu:Pro:16.04:LTSlibspring-java3.2.13-4, 0, 3.2.13-3
Ubuntu:Pro:18.04:LTSlibspring-java4.3.22-1~18.04, 4.3.14-1, 0
Ubuntu:Pro:22.04:LTSlibspring-java0, 4.3.30-1, *
Ubuntu:Pro:14.04:LTSlibspring-java3.0.6.RELEASE-9, 3.0.6.RELEASE-7, *
Ubuntu:25.10libspring-java0, 4.3.30-2ubuntu1, 4.3.30-3ubuntu1
Ubuntu:Pro:20.04:LTSlibspring-java0, 4.3.22-4, 4.3.22-4ubuntu0.1~esm1

Timeline

  • CVE Published
  • Apr 14, 2021 EPSS Score
  • Sep 22, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • Jun 24, 2022 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Apr 13, 2023 EPSS Score
  • Apr 25, 2023 EPSS Score
  • May 22, 2023 EPSS Score
  • Jul 8, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›