CVEvulnerability

CVE-2020-5421

6.5 MEDIUM Published 2020-09-19 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2020-09-19
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
CVSS 3.0 ([email protected])
8.7 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS 2.0 ([email protected])
3.6 LOW — AV:N/AC:H/Au:S/C:P/I:P/A:N

Description

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

Affected configurations

• vmware spring framework (< 4.3.29) • vmware spring framework (>= 5.0.0 < 5.0.19) • vmware spring framework (>= 5.1.0 < 5.1.18) • vmware spring framework (>= 5.2.0 < 5.2.9) • oracle commerce guided search 11.3.2 • oracle communications brm 11.3.0.9 • oracle communications brm 12.0.0.3 • oracle communications design studio 7.3.4 • oracle communications design studio 7.3.5 • oracle communications design studio 7.4.0 • oracle communications session report manager (>= 8.2.1 <= 8.2.2.1) • oracle communications unified inventory management 7.3.4 • oracle communications unified inventory management 7.3.5 • oracle endeca information discovery integrator 3.2.0 • oracle enterprise data quality 12.2.1.3.0 • oracle enterprise data quality 12.2.1.4.0 • oracle financial services analytical applications infrastructure (>= 8.0.6 <= 8.1.0) • oracle flexcube private banking 12.0.0 • oracle flexcube private banking 12.1.0 • oracle fusion middleware 12.2.1.3.0 • oracle fusion middleware 12.2.1.4.0 • oracle goldengate application adapters 19.1.0.0.0 • oracle healthcare master person index 4.0.2.5 • oracle hyperion infrastructure technology 11.1.2.4 • oracle insurance policy administration (>= 11.1.0 <= 11.3.0) • oracle insurance policy administration 10.2 • oracle insurance policy administration 10.2.4 • oracle insurance policy administration 11.0.2 • oracle insurance rules palette (>= 11.1.0 <= 11.3.0) • oracle insurance rules palette 10.2.0 • oracle insurance rules palette 10.2.4 • oracle insurance rules palette 11.0.2 • oracle mysql enterprise monitor (<= 8.0.22) • oracle mysql enterprise monitor 8.0.23 • oracle primavera gateway (>= 16.2.0 <= 16.2.11) • oracle primavera gateway (>= 17.12.0 <= 17.12.9) • oracle primavera gateway (>= 18.8.0 <= 18.8.10) • oracle primavera gateway (>= 19.12.0 <= 19.12.10) • oracle primavera p6 enterprise project portfolio management (>= 16.1.0 <= 16.2.20) • oracle primavera p6 enterprise project portfolio management (>= 17.1.0 <= 17.12.19) • oracle primavera p6 enterprise project portfolio management (>= 18.1.0 <= 18.8.21) • oracle primavera p6 enterprise project portfolio management (>= 19.12.0 <= 19.12.10) • oracle retail assortment planning 16.0.3.0 • oracle retail bulk data integration 16.0.3.0 • oracle retail customer engagement (>= 16.0 <= 19.0) • oracle retail customer management and segmentation foundation (>= 16.0 <= 19.0) • oracle retail financial integration 14.1.3 • oracle retail financial integration 15.0.3 • oracle retail financial integration 16.0.3 • oracle retail integration bus 14.1.3 • oracle retail integration bus 15.0.3 • oracle retail integration bus 16.0.3 • oracle retail invoice matching 14.0 • oracle retail invoice matching 14.1 • oracle retail merchandising system 16.0.3 • oracle retail order broker 15.0 • oracle retail order broker 16.0 • oracle retail predictive application server 14.1 • oracle retail returns management 14.1 • oracle retail service backbone 14.1.3 … and 17 more

References