CVE-2020-5398 Public exploit High · 8.0 EPSS 88.3%
RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
Spring · Spring Framework
Official description · CVE.org
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
31.2 / 100
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure. No confirmed exploitation is recorded.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+1 day
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
7 fixes in spring-webmvc over 10 years. The latest fix listed for spring-webmvc is 6.0.7.
Fixes in spring-webmvcMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 4.1.2CVE-2014-362520 Nov 2014
- 4.3.5CVE-2016-987829 Dec 2016
- 5.2.3.RELEASECVE-2020-539816 Jan 2020
- 5.2.3CVE-2020-539717 Jan 2020
- 5.3.18CVE-2022-229651 Apr 2022KEV
- 5.3.42CVE-2024-3882818 Nov 2024
- 6.0.7CVE-2023-2086027 Mar 2023Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Mavenorg.springframework:spring-webmvcAffected: 5.2.0.RELEASE up to 5.2.3.RELEASE; 5.1.0.RELEASE up to 5.1.13.RELEASE; 5.0.0.RELEASE up to 5.0.16.RELEASEUpgrade to 5.2.20.RELEASE or later (older lines: 5.1.13.RELEASE, 5.0.16.RELEASE)
- Mavenorg.springframework:spring-webfluxAffected: 5.2.0.RELEASE up to 5.2.3.RELEASE; 5.1.0.RELEASE up to 5.1.13.RELEASE; 5.0.0.RELEASE up to 5.0.16.RELEASEUpgrade to 5.2.20.RELEASE or later (older lines: 5.1.13.RELEASE, 5.0.16.RELEASE)
What security researchers reported
Not named in any threat report yetAlso mentioned in 1 community threat pulse (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.