What’s Vulnerable › Vulnerabilities

CVE-2020-5397: CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-01-17 · updated 2026-06-17
• Weakness: CWE-352

Description

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.

Affected products

• Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
• Oracle Corporation Communications BRM - Elastic Charging Engine: 11.3, 12.0
• Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.2.2
• Oracle Communications Element Manager: 8.1.1, 8.2.0, 8.2.1
• Oracle Corporation Communications Policy Management: 12.5.0
• Oracle Communications Session Route Manager: 8.1.1, 8.2.0, 8.2.1
• Oracle Corporation Enterprise Manager Base Platform: 13.2.1.0
• Oracle Financial Services Regulatory Reporting With Agilereporter: 8.0.9.2.0
• Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
• Oracle Healthcare Master Person Index: 4.0.2
• Oracle Insurance Calculation Engine: from 11.0.0 through 11.3.1
• Oracle Insurance Policy Administration J2Ee: 10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0
• Oracle Insurance Rules Palette: 10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0
• Oracle Corporation MySQL Enterprise Monitor: from 4.0.0 through 4.0.12; from 8.0.0 through 8.0.20
• Oracle Corporation Rapid Planning: 12.1, 12.2
• Oracle Retail Assortment Planning: 15.0, 16.0
• Oracle Corporation Retail Back Office: 14.1
• Oracle Corporation Retail Central Office: 14.1
• Oracle Retail Financial Integration: 15.0, 16.0
• Oracle Corporation Oracle Retail Integration Bus: 15.0.3, 16.0.3
• Oracle Retail Order Broker: 15.0, 16.0
• Oracle Corporation Retail Point-of-Service: 14.1
• Oracle Retail Predictive Application Server: 14.0.3, 14.1.3, 15.0.3.0, 16.0.3.0
• Oracle Corporation Retail Returns Management: 14.1
• Oracle Retail Service Backbone: 15.0, 16.0
• Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0
• Spring Framework: from 5.2.0 before 5.2.3 — fixed in 5.2.3
• Spring Framework: from 5.2 before v5.2.3.RELEASE — fixed in v5.2.3.RELEASE

How to fix

Upgrade to a fixed version: Spring Framework 5.2.3; Spring Framework v5.2.3.RELEASE. Check the vendor advisory for mitigations.

References

• https://pivotal.io/security/cve-2020-5397
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://pivotal.io/security/cve-2020-5397
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2020-5397 or the next vulnerability affects your stack