CVE-2020-5398
Published on: 01/16/2020 12:00:00 AM UTC
Last Modified on: 07/25/2022 07:09:12 PM UTC
Certain versions of Data Availability Services from Netapp contain the following vulnerability:
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
- CVE-2020-5398 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity. - Affected Vendor/Software: Spring - Spring Framework version v5.0.16.RELEASE
- Affected Vendor/Software: Spring - Spring Framework version v5.1.13.RELEASE
- Affected Vendor/Software: Spring - Spring Framework version v5.2.3.RELEASE
CVSS3 Score: 7.5 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | HIGH | NONE | REQUIRED |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | HIGH |
CVSS2 Score: 7.6 - HIGH
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | HIGH | NONE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| COMPLETE | COMPLETE | COMPLETE |
CVE References
MLIST [karaf-commits] 20200518 [GitHub] [karaf] jbonofre removed a comment on pull request #1118: KARAF-6721 - Update Spring versions due to CVE-2020-5398
MISC www.oracle.com/security-alerts/cpujul2020.html
CONFIRM security.netapp.com/advisory/ntap-20210917-0006/Related QID Numbers
Known Affected Configurations (CPE V2.3)
- cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*:
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.5.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:financial_services_regulatory_reporting_with_agilereporter:8.0.9.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:healthcare_master_person_index:4.0.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_calculation_engine:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.4:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.2.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_rules_palette:10.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_rules_palette:10.2.4:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_rules_palette:11.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_rules_palette:11.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_assortment_planning:15.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_assortment_planning:16.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_financial_integration:15.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_financial_integration:16.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_integration_bus:15.0.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_predictive_application_server:14.0.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:siebel_engineering_-_installer_\&_deployment:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*:
- cpe:2.3:a:pivotal_software:spring_framework:5.1.0:-:*:*:*:*:*:*:
- cpe:2.3:a:pivotal_software:spring_framework:5.1.0:rc1:*:*:*:*:*:*:
- cpe:2.3:a:pivotal_software:spring_framework:5.1.0:rc2:*:*:*:*:*:*:
- cpe:2.3:a:pivotal_software:spring_framework:5.1.0:rc3:*:*:*:*:*:*:
- cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*:
- cpe:2.3:a:pivotal_software:spring_framework:5.1.0:-:*:*:*:*:*:*:
- cpe:2.3:a:pivotal_software:spring_framework:5.1.0:rc1:*:*:*:*:*:*:
- cpe:2.3:a:pivotal_software:spring_framework:5.1.0:rc2:*:*:*:*:*:*:
- cpe:2.3:a:pivotal_software:spring_framework:5.1.0:rc3:*:*:*:*:*:*:
- cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*:
- cpe:2.3:a:vmware:spring_framework:5.1.0:-:*:*:*:*:*:*:
- cpe:2.3:a:vmware:spring_framework:5.1.0:rc1:*:*:*:*:*:*:
- cpe:2.3:a:vmware:spring_framework:5.1.0:rc2:*:*:*:*:*:*:
- cpe:2.3:a:vmware:spring_framework:5.1.0:rc3:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|