CVE-2020-5398
RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
HIGH 7.5EPSS 88.8%
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
- Affected
- Spring · Spring Framework
- CVSS v3.1 NVD
- 7.5 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v3.0 PIVOTAL
- 8.0 HIGH
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS v2.0 NVD
- 7.6 HIGH
AV:N/AC:H/Au:N/C:C/I:C/A:C - EPSS
- 88.77% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- highx
- Published
- 2020-01-16
- Updated
- 2026-10-08
Proof-of-concept exploits (1)
- motikan2010/CVE-2020-539884★ · 2022-12-15
Nuclei templates (1)
Security advisories
- https://pivotal.io/security/cve-2020-5398
- https://security.netapp.com/advisory/ntap-20210917-0006
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- advisories/GHSA-8wx2-9q48-vm9r
- https://www.oracle.com/security-alerts/cpujul2022.html