RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

高危 7.5CVE-2020-5398 · GHSA-8wx2-9q48-vm9r · Published 17/01/2020 · updated 08/10/2026

要点

CVE-2020-5398 是影响 org.springframework:spring-webflux, org.springframework:spring-webmvc, application testing suite (oracle) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：88.3%，高于 99.8% 的漏洞。
修复：升级到 5.0.16.RELEASE, 5.1.13.RELEASE, 5.2.3.RELEASE, 5.0.16 或更高版本。

Package	Affected versions	Patched versions
org.springframework:spring-webflux Maven	`≥ 5.0.0.RELEASE, < 5.0.16.RELEASE≥ 5.1.0.RELEASE, < 5.1.13.RELEASE≥ 5.2.0.RELEASE, < 5.2.3.RELEASE`	`5.0.16.RELEASE5.1.13.RELEASE5.2.3.RELEASE`
org.springframework:spring-webmvc Maven	`≥ 5.0.0.RELEASE, < 5.0.16.RELEASE≥ 5.1.0.RELEASE, < 5.1.13.RELEASE≥ 5.2.0.RELEASE, < 5.2.3.RELEASE`	`5.0.16.RELEASE5.1.13.RELEASE5.2.3.RELEASE`
application testing suite oracle	`= 13.3.0.1`	No fix yet
communications billing and revenue management elastic charging engine oracle	`= 11.3= 12.0`	No fix yet
communications cloud native core policy oracle	`= 1.5.0`	No fix yet
communications diameter signaling router oracle	`≥ 8.0.0, ≤ 8.2.2`	No fix yet
communications element manager oracle	`= 8.1.1= 8.2.0= 8.2.1`	No fix yet
communications policy management oracle	`= 12.5.0`	No fix yet
communications session report manager oracle	`= 8.1.1= 8.2.0= 8.2.1`	No fix yet
communications session route manager oracle	`= 8.1.1= 8.2.0= 8.2.1`	No fix yet
enterprise manager base platform oracle	`= 13.2.1.0`	No fix yet
financial services regulatory reporting with agilereporter oracle	`= 8.0.9.2.0`	No fix yet
flexcube private banking oracle	`= 12.0.0= 12.1.0`	No fix yet
healthcare master person index oracle	`= 4.0.2`	No fix yet
insurance calculation engine oracle	`≥ 11.0.0, ≤ 11.3.1`	No fix yet
insurance policy administration j2ee oracle	`= 10.2.0= 10.2.4= 11.0.2= 11.1.0= 11.2.0= 11.2.2.0`	No fix yet
insurance rules palette oracle	`= 10.2.0= 10.2.4= 11.0.2= 11.1.0= 11.2.0`	No fix yet
mysql oracle	`≥ 4.0.0, ≤ 4.0.12≥ 8.0.0, ≤ 8.0.20`	No fix yet
rapid planning oracle	`= 12.1= 12.2`	No fix yet
retail assortment planning oracle	`= 15.0= 16.0`	No fix yet
retail back office oracle	`= 14.1`	No fix yet
retail bulk data integration oracle	`= 16.0.3.0`	No fix yet
retail central office oracle	`= 14.1`	No fix yet
retail financial integration oracle	`= 15.0= 16.0`	No fix yet
retail integration bus oracle	`= 15.0.3= 16.0.3`	No fix yet
retail order broker oracle	`= 15.0= 16.0`	No fix yet
retail point-of-service oracle	`= 14.1`	No fix yet
retail predictive application server oracle	`= 14.0.3= 14.1.3.0= 15.0.3= 16.0.3.0`	No fix yet
retail returns management oracle	`= 14.1`	No fix yet
retail service backbone oracle	`= 15.0= 16.0`	No fix yet
siebel engineering - installer & deployment oracle	`≤ 2.1.1`	No fix yet
weblogic server oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
spring framework vmware	`≥ 5.0.0, < 5.0.16≥ 5.1.0, < 5.1.13≥ 5.2.0, < 5.2.3`	`5.0.165.1.135.2.3`

Description

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

NVD description

References

org.springframework:spring-webflux 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free