Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2020-5421

RFD Protection Bypass via jsessionid

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
pivotal

Description

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring by VMware Spring Framework

  • 4.3 to < 4.3.29affected
  • 5.0 to < 5.0.19affected
  • 5.1 to < 5.1.18affected
  • 5.2 to < 5.2.9affected

References