Skip to content
Fencer Vulns
high 8.7

CVE-2020-5421 in the critical feed json

RFD Protection Bypass via jsessionid

published 2020-09-19 6 y ago modified 2026-10-08 31 d ago also GHSA-rv39-3qh7-9v7w , EUVD-2021-0875

cvss
8.7
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
11.6%
EPSS 11.6% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

Patch / fix

  • maven org.springframework:spring-framework-bom 4.3.29, 5.0.19, 5.1.18, 5.2.9
  • Spring by VMware Spring Framework 4.3.29, 5.0.19, 5.1.18, 5.2.9
  • libspring-java Debian 14, Debian 13, Debian 12 4.3.30-1

debian advisories DEBIAN-CVE-2020-5421

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-5421 updated cvss 6.5

springframework: RFD protection bypass via jsessionid

  • Red Hat JBoss BRMS 5 springframework springframework Red Hat JBoss Data Virtualization 6 springframework springframework Red Hat JBoss Fuse 6 springframework springframework Red Hat JBoss Fuse Service Works 6 springframework springframework Red Hat JBoss SOA Platform 5 springframework springframework
    affected: no fix planned “Out of support scope”
  • Red Hat Fuse 7.9
    fixed: vendor fix RHSA-2021:3140
  • Red Hat Storage 3 rhevm-dependencies Red Hat Virtualization 4 rhvm-dependencies
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
31 d ago

Exploit prediction

11.56% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 8.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
NVD 2.0 3.6 AV:N/AC:H/Au:S/C:P/I:P/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.springframework:spring-framework-bom
>=5.2.0, <5.2.9
>=5.1.0, <5.1.18
>=5.0.0, <5.0.19
<4.3.29
5.2.9
5.1.18
5.0.19
4.3.29

Affected products

  • Spring by VMware Spring Framework

Classification

Weakness
  • CWE-35 Path Traversal: '.../...//'
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.