What’s Vulnerable › Vulnerabilities
CVE-2020-5421: RFD Protection Bypass via jsessionid
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 11.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-09-19 · updated 2026-10-08
Description
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
Affected products
- OnCommand Insight: all versions
- NetApp Snap Creator Framework: all versions
- NetApp SnapCenter: all versions
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
- Oracle Communications Brm: 11.3.0.9, 12.0.0.3
- Oracle Communications Design Studio: 7.3.4, 7.3.5, 7.4.0
- Oracle Communications Session Report Manager: from 8.2.1 through 8.2.2.1
- Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.4, 7.3.5
- Oracle Corporation Endeca Information Discovery Integrator: 3.2.0
- Oracle Corporation Enterprise Data Quality: 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6 through 8.1.0
- Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
- Oracle Corporation Oracle Enterprise Manager for Fusion Middleware: 12.2.1.3.0, 12.2.1.4.0
- Oracle Goldengate Application Adapters: 19.1.0.0.0
- Oracle Healthcare Master Person Index: 4.0.2.5
- Oracle Corporation Oracle Hyperion Infrastructure Technology: 11.1.2.4
- Oracle Insurance Policy Administration: from 11.1.0 through 11.3.0; 10.2, 10.2.4, 11.0.2
- Oracle Insurance Rules Palette: from 11.1.0 through 11.3.0; 10.2.0, 10.2.4, 11.0.2
- Oracle Corporation MySQL Enterprise Monitor: through 8.0.22; 8.0.23
- Oracle Corporation Primavera Gateway: from 16.2.0 through 16.2.11; from 17.12.0 through 17.12.9; from 18.8.0 through 18.8.10; from 19.12.0 through 19.12.10
- Oracle Corporation Primavera P6 Enterprise Project Portfolio Management: from 16.1.0 through 16.2.20; from 17.1.0 through 17.12.19; from 18.1.0 through 18.8.21; from 19.12.0 through 19.12.10
- Oracle Retail Assortment Planning: 16.0.3.0
- Oracle Corporation Retail Bulk Data Integration: 16.0.3.0
- Oracle Retail Customer Engagement: from 16.0 through 19.0
- Oracle Corporation Retail Customer Management and Segmentation Foundation: from 16.0 through 19.0
- Oracle Retail Financial Integration: 14.1.3, 15.0.3, 16.0.3
- Oracle Corporation Oracle Retail Integration Bus: 14.1.3, 15.0.3, 16.0.3
- Oracle Corporation Retail Invoice Matching: 14.0, 14.1
- Oracle Corporation Retail Merchandising System: 16.0.3
- Oracle Retail Order Broker: 15.0, 16.0
How to fix
Upgrade to a fixed version: Spring Framework 4.3.29, 5.0.19, 5.1.18, 5.2.9; Spring Framework 4.3.29, 5.0.19, 5.1.18, 5.2.9. Check the vendor advisory for mitigations.
References
- https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163%40%3Ccommits.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a%40%3Cissues.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r3589ed0d18edeb79028615080d5a0e8878856436bb91774a3196d9eb%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r503e64b43a57fd68229cac4a869d1a9a2eac9e75f8719cad3a840211%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5%40%3Cissues.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r7e6a213eea7f04fc6d9e3bd6eb8d68c4df92a22e956e95cb2c482865%40%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a%40%3Cdev.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r918caad55dcc640a16753b00d8d6acb90b4e36de4b6156d0867246ec%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1%40%3Cdev.ambari.apache.org%3E
- https://lists.apache.org/thread.html/ra889d95141059c6cbe77dd80249bb488ae53b274b5f3abad09d9511d%40%3Cuser.ignite.apache.org%3E
- https://lists.apache.org/thread.html/raf7ca57033e537e4f9d7df7f192fa6968c1e49409b2348e08d807ccb%40%3Cuser.ignite.apache.org%3E
- https://lists.apache.org/thread.html/rb18ed999153ef0f0cb7af03efe0046c42c7242fd77fbd884a75ecfdc%40%3Ccommits.pulsar.apache.org%3E
Get alerted when CVE-2020-5421 or the next vulnerability affects your stack