GitHub Advisoryadvisory · Maven

GHSA-rv39-3qh7-9v7w Improper Input Validation in Spring Framework

MEDIUM Published 2021-04-30 Modified 2022-02-08 Official page ↗
Aliases
CVE-2020-5421
Ecosystem
Maven
Packages
org.springframework:spring-framework-bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
Weaknesses
CWE-35
Reviewed
2021-04-27

Affected packages

• Maven org.springframework:spring-framework-bom: >= 5.2.0, < 5.2.9 → fixed in 5.2.9 • Maven org.springframework:spring-framework-bom: >= 5.1.0, < 5.1.18 → fixed in 5.1.18 • Maven org.springframework:spring-framework-bom: >= 5.0.0, < 5.0.19 → fixed in 5.0.19 • Maven org.springframework:spring-framework-bom: < 4.3.29 → fixed in 4.3.29

Description

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

Related

Alias · CVE (1)

  • CVE-2020-5421 In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections… vulnerability

Weakness · CWE (1)

  • CWE-35 Path Traversal: '.../...//' weakness

References