Improper Input Validation in Spring Framework

보통 6.5CVE-2020-5421 · GHSA-rv39-3qh7-9v7w · Published 19/09/2020 · updated 08/10/2026

요약

CVE-2020-5421은(는) org.springframework:spring-framework-bom, commerce guided search (oracle), communications brm (oracle)에 영향을 주는 보통 (CVSS 6.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 11.6%, 전체 취약점의 96.0%보다 높음.
조치: 5.0.19, 5.1.18, 5.2.9, 4.3.29 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
org.springframework:spring-framework-bom Maven	`≥ 5.0.0, < 5.0.19≥ 5.1.0, < 5.1.18≥ 5.2.0, < 5.2.9< 4.3.29`	`5.0.195.1.185.2.94.3.29`
commerce guided search oracle	`= 11.3.2`	No fix yet
communications brm oracle	`= 11.3.0.9= 12.0.0.3`	No fix yet
communications design studio oracle	`= 7.3.4= 7.3.5= 7.4.0`	No fix yet
communications session report manager oracle	`≥ 8.2.1, ≤ 8.2.2.1`	No fix yet
communications unified inventory management oracle	`= 7.3.4= 7.3.5`	No fix yet
endeca information discovery integrator oracle	`= 3.2.0`	No fix yet
enterprise data quality oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
financial services analytical applications infrastructure oracle	`≥ 8.0.6, ≤ 8.1.0`	No fix yet
flexcube private banking oracle	`= 12.0.0= 12.1.0`	No fix yet
fusion middleware oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
goldengate application adapters oracle	`= 19.1.0.0.0`	No fix yet
healthcare master person index oracle	`= 4.0.2.5`	No fix yet
hyperion infrastructure technology oracle	`= 11.1.2.4`	No fix yet
insurance policy administration oracle	`= 10.2= 10.2.4= 11.0.2≥ 11.1.0, ≤ 11.3.0`	No fix yet
insurance rules palette oracle	`= 10.2.0= 10.2.4= 11.0.2≥ 11.1.0, ≤ 11.3.0`	No fix yet
mysql enterprise monitor oracle	`= 8.0.23≤ 8.0.22`	No fix yet
primavera gateway oracle	`≥ 16.2.0, ≤ 16.2.11≥ 17.12.0, ≤ 17.12.9≥ 18.8.0, ≤ 18.8.10≥ 19.12.0, ≤ 19.12.10`	No fix yet
primavera p6 enterprise project portfolio management oracle	`≥ 16.1.0, ≤ 16.2.20≥ 17.1.0, ≤ 17.12.19≥ 18.1.0, ≤ 18.8.21≥ 19.12.0, ≤ 19.12.10`	No fix yet
retail assortment planning oracle	`= 16.0.3.0`	No fix yet
retail bulk data integration oracle	`= 16.0.3.0`	No fix yet
retail customer engagement oracle	`≥ 16.0, ≤ 19.0`	No fix yet
retail customer management and segmentation foundation oracle	`≥ 16.0, ≤ 19.0`	No fix yet
retail financial integration oracle	`= 14.1.3= 15.0.3= 16.0.3`	No fix yet
retail integration bus oracle	`= 14.1.3= 15.0.3= 16.0.3`	No fix yet
retail invoice matching oracle	`= 14.0= 14.1`	No fix yet
retail merchandising system oracle	`= 16.0.3`	No fix yet
retail order broker oracle	`= 15.0= 16.0`	No fix yet
retail predictive application server oracle	`= 14.1`	No fix yet
retail returns management oracle	`= 14.1`	No fix yet
retail service backbone oracle	`= 14.1.3= 15.0.3= 16.0.3`	No fix yet
retail xstore point of service oracle	`= 15.0.4= 16.0.6= 17.0.4= 18.0.3= 19.0.2`	No fix yet
storagetek acsls oracle	`= 8.5.1`	No fix yet
storagetek tape analytics sw tool oracle	`= 2.3`	No fix yet
weblogic server oracle	`= 10.3.6.0.0= 12.1.3.0.0= 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0`	No fix yet
spring framework vmware	`≥ 5.0.0, < 5.0.19≥ 5.1.0, < 5.1.18≥ 5.2.0, < 5.2.9< 4.3.29`	`5.0.195.1.185.2.94.3.29`

Description

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

NVD description

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free