CVE-2020-5421
RFD Protection Bypass via jsessionid
MEDIUM 6.5EPSS 11.6%
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
- Affected
- Spring by VMware · Spring Framework
- CVSS v3.1 NVD
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N - CVSS v3.0 PIVOTAL
- 8.7 HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - CVSS v2.0 NVD
- 3.6 LOW
AV:N/AC:H/Au:S/C:P/I:P/A:N - EPSS
- 11.56% chance of exploitation in the next 30 days, 96th percentile
- Published
- 2020-09-19
- Updated
- 2026-10-08
Proof-of-concept exploits (1)
- pandaMingx/CVE-2020-54213★ · 2021-01-10
Security advisories
- https://tanzu.vmware.com/security/cve-2020-5421
- https://security.netapp.com/advisory/ntap-20210513-0009
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- advisories/GHSA-rv39-3qh7-9v7w