High severity · published Jan 16, 2020
CVE-2020-5398
RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
7.5
CVSS
88.3%
EPSS
No
On KEV
Description
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)88.3% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MY
MySQL · Oracle
4.0.0 through 4.0.12; 8.0.0 through 8.0.20 · source: NVD
WS
WebLogic Server · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
SF
Spring Framework · Spring
5.0 before v5.0.16.RELEASE; 5.1 before v5.1.13.RELEASE; 5.2 before v5.2.3.RELEASE · source: vendor, NVD
AT
Application Testing Suite · Oracle
13.3.0.1 · source: NVD
CB
Communications Billing And Revenue Management Elastic Charging Engine · Oracle
11.3; 12.0 · source: NVD
CC
Communications Cloud Native Core Policy · Oracle
1.5.0 · source: NVD
CD
Communications Diameter Signaling Router · Oracle
8.0.0 through 8.2.2 · source: NVD
CE
Communications Element Manager · Oracle
8.1.1; 8.2.0; 8.2.1 · source: NVD
CP
Communications Policy Management · Oracle
12.5.0 · source: NVD
CS
Communications Session Report Manager · Oracle
8.1.1; 8.2.0; 8.2.1 · source: NVD
CS
Communications Session Route Manager · Oracle
8.1.1; 8.2.0; 8.2.1 · source: NVD
DA
Data Availability Services · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5398
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5398
lists.apache.org
https://lists.apache.org/thread.html/r028977b9b9d44a89823639aa3296fb0f0cfdd76b4450df89d3c4fbbf%40%3Cissues.karaf.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r0f2d0ae1bad2edb3d4a863d77f3097b5e88cfbdae7b809f4f42d6aad%40%3Cissues.karaf.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r0f3530f7cb510036e497532ffc4e0bd0b882940448cf4e233994b08b%40%3Ccommits.karaf.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r1accbd4f31ad2f40e1661d70a4510a584eb3efd1e32e8660ccf46676%40%3Ccommits.karaf.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r1bc5d673c01cfbb8e4a91914e9748ead3e5f56b61bca54d314c0419b%40%3Cissues.karaf.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163%40%3Ccommits.ambari.apache.org%3E
More from MySQL
9.8
CVE-2020-11656
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement
9.8
CVE-2019-14540
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10
9.8
CVE-2016-9843
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation
9.8
CVE-2016-9841
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic
9.8
CVE-2016-6662
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before…