CVEvulnerability

CVE-2020-5397

5.3 MEDIUM Published 2020-01-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-01-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.0 ([email protected])
5.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:N/I:P/A:N
Weaknesses
CWE-352

Description

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.

Affected configurations

• vmware spring framework (>= 5.2.0 < 5.2.3) • oracle application testing suite 13.3.0.1 • oracle communications brm - elastic charging engine 11.3 • oracle communications brm - elastic charging engine 12.0 • oracle communications diameter signaling router (>= 8.0.0 <= 8.2.2) • oracle communications element manager 8.1.1 • oracle communications element manager 8.2.0 • oracle communications element manager 8.2.1 • oracle communications policy management 12.5.0 • oracle communications session route manager 8.1.1 • oracle communications session route manager 8.2.0 • oracle communications session route manager 8.2.1 • oracle enterprise manager base platform 13.2.1.0 • oracle financial services regulatory reporting with agilereporter 8.0.9.2.0 • oracle flexcube private banking 12.0.0 • oracle flexcube private banking 12.1.0 • oracle healthcare master person index 4.0.2 • oracle insurance calculation engine (>= 11.0.0 <= 11.3.1) • oracle insurance policy administration j2ee 10.2.0 • oracle insurance policy administration j2ee 10.2.4 • oracle insurance policy administration j2ee 11.0.2 • oracle insurance policy administration j2ee 11.1.0 • oracle insurance policy administration j2ee 11.2.0 • oracle insurance rules palette 10.2.0 • oracle insurance rules palette 10.2.4 • oracle insurance rules palette 11.0.2 • oracle insurance rules palette 11.1.0 • oracle insurance rules palette 11.2.0 • oracle mysql enterprise monitor (>= 4.0.0 <= 4.0.12) • oracle mysql enterprise monitor (>= 8.0.0 <= 8.0.20) • oracle rapid planning 12.1 • oracle rapid planning 12.2 • oracle retail assortment planning 15.0 • oracle retail assortment planning 16.0 • oracle retail back office 14.1 • oracle retail central office 14.1 • oracle retail financial integration 15.0 • oracle retail financial integration 16.0 • oracle retail integration bus 15.0.3 • oracle retail integration bus 16.0.3 • oracle retail order broker 15.0 • oracle retail order broker 16.0 • oracle retail point-of-service 14.1 • oracle retail predictive application server 14.0.3 • oracle retail predictive application server 14.1.3 • oracle retail predictive application server 15.0.3.0 • oracle retail predictive application server 16.0.3.0 • oracle retail returns management 14.1 • oracle retail service backbone 15.0 • oracle retail service backbone 16.0 • oracle weblogic server 12.2.1.3.0 • oracle weblogic server 12.2.1.4.0

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References