What’s Vulnerable › Vulnerabilities
CVE-2020-5398: RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 88.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-01-16 · updated 2026-10-08
- Weakness: CWE-79
Description
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Affected products
- NetApp Data Availability Services: all versions
- NetApp SnapCenter: all versions
- Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
- Oracle Corporation Oracle Communications BRM - Elastic Charging Engine: 11.3, 12.0
- Oracle Communications Cloud Native Core Policy: 1.5.0
- Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.2.2
- Oracle Communications Element Manager: 8.1.1, 8.2.0, 8.2.1
- Oracle Corporation Communications Policy Management: 12.5.0
- Oracle Communications Session Report Manager: 8.1.1, 8.2.0, 8.2.1
- Oracle Communications Session Route Manager: 8.1.1, 8.2.0, 8.2.1
- Oracle Corporation Enterprise Manager Base Platform: 13.2.1.0
- Oracle Financial Services Regulatory Reporting With Agilereporter: 8.0.9.2.0
- Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
- Oracle Healthcare Master Person Index: 4.0.2
- Oracle Insurance Calculation Engine: from 11.0.0 through 11.3.1
- Oracle Insurance Policy Administration J2Ee: 10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0, 11.2.2.0
- Oracle Insurance Rules Palette: 10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0
- MySQL Server: from 4.0.0 through 4.0.12; from 8.0.0 through 8.0.20
- Oracle Corporation Rapid Planning: 12.1, 12.2
- Oracle Retail Assortment Planning: 15.0, 16.0
- Oracle Corporation Retail Back Office: 14.1
- Oracle Corporation Retail Bulk Data Integration: 16.0.3.0
- Oracle Corporation Retail Central Office: 14.1
- Oracle Retail Financial Integration: 15.0, 16.0
- Oracle Corporation Oracle Retail Integration Bus: 15.0.3, 16.0.3
- Oracle Retail Order Broker: 15.0, 16.0
- Oracle Corporation Retail Point-of-Service: 14.1
- Oracle Retail Predictive Application Server: 14.0.3, 14.1.3.0, 15.0.3, 16.0.3.0
- Oracle Corporation Retail Returns Management: 14.1
- Oracle Retail Service Backbone: 15.0, 16.0
How to fix
Upgrade to a fixed version: Spring Framework 5.0.16, 5.1.13, 5.2.3; Spring Framework v5.0.16.RELEASE, v5.1.13.RELEASE, v5.2.3.RELEASE. Check the vendor advisory for mitigations.
References
- https://lists.apache.org/thread.html/r028977b9b9d44a89823639aa3296fb0f0cfdd76b4450df89d3c4fbbf%40%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r0f2d0ae1bad2edb3d4a863d77f3097b5e88cfbdae7b809f4f42d6aad%40%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r0f3530f7cb510036e497532ffc4e0bd0b882940448cf4e233994b08b%40%3Ccommits.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r1accbd4f31ad2f40e1661d70a4510a584eb3efd1e32e8660ccf46676%40%3Ccommits.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r1bc5d673c01cfbb8e4a91914e9748ead3e5f56b61bca54d314c0419b%40%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163%40%3Ccommits.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a%40%3Cissues.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r27552d2fa10d96f2810c50d16ad1fd1899e37796c81a0c5e7585a02d%40%3Cdev.rocketmq.apache.org%3E
- https://lists.apache.org/thread.html/r2dfd5b331b46d3f90c4dd63a060e9f04300468293874bd7e41af7163%40%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r3765353ff434fd00d8fa5a44734b3625a06eeb2a3fb468da7dfae134%40%3Ccommits.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r4639e821ef9ca6ca10887988f410a60261400a7766560e7a97a22efc%40%3Ccommits.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r4b1886e82cc98ef38f582fef7d4ea722e3fcf46637cd4674926ba682%40%3Cissues.karaf.apache.org%3E
Get alerted when CVE-2020-5398 or the next vulnerability affects your stack