CVE catalog
CVE-2020-5398
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it s
- Severity
- High · CVSS 8
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 88.32% · Oct 27, 2026
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libspring-java | sid | 4.3.30-6 | not affected |
| Debian | libspring-java | forky | 4.3.30-6 | not affected |
| Debian | libspring-java | trixie | 4.3.30-3 | not affected |
| Debian | libspring-java | bookworm | 4.3.30-2 | not affected |
| Cpe | spring_framework | Not reported | 5.0.16 | fixed |
| Cpe | spring_framework | Not reported | 5.1.13 | fixed |
| Cpe | spring_framework | Not reported | 5.2.3 | fixed |
| Cpe | application_testing_suite | Not reported | Not reported | unknown |
| Cpe | communications_billing_and_revenue_management_elastic_charging_engine | Not reported | Not reported | unknown |
| Cpe | communications_billing_and_revenue_management_elastic_charging_engine | Not reported | Not reported | unknown |
| Cpe | communications_cloud_native_core_policy | Not reported | Not reported | unknown |
| Cpe | communications_diameter_signaling_router | Not reported | Not reported | unknown |
| Cpe | communications_element_manager | Not reported | Not reported | unknown |
| Cpe | communications_element_manager | Not reported | Not reported | unknown |
| Cpe | communications_element_manager | Not reported | Not reported | unknown |
| Cpe | communications_policy_management | Not reported | Not reported | unknown |
| Cpe | communications_session_report_manager | Not reported | Not reported | unknown |
| Cpe | communications_session_report_manager | Not reported | Not reported | unknown |
| Cpe | communications_session_report_manager | Not reported | Not reported | unknown |
| Cpe | communications_session_route_manager | Not reported | Not reported | unknown |
| Cpe | communications_session_route_manager | Not reported | Not reported | unknown |
| Cpe | communications_session_route_manager | Not reported | Not reported | unknown |
| Cpe | enterprise_manager_base_platform | Not reported | Not reported | unknown |
| Cpe | financial_services_regulatory_reporting_with_agilereporter | Not reported | Not reported | unknown |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libspring-java | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | libspring-java | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | libspring-java | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | libspring-java | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Cpe | spring_framework | cpe | Not reported | 5.0.16 | Not reported | NVD-CVE-2020-5398 | Not reported |
| Cpe | spring_framework | cpe | Not reported | 5.1.13 | Not reported | NVD-CVE-2020-5398 | Not reported |
| Cpe | spring_framework | cpe | Not reported | 5.2.3 | Not reported | NVD-CVE-2020-5398 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libspring-aop-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-beans-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-context-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-context-support-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-core-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-expression-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-instrument-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-jdbc-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-jms-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-messaging-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-orm-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-oxm-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-test-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-transaction-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-web-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-web-portlet-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
- [libspring-web-servlet-java]Not affected
Source package: [libspring-java]
Details (2)
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
4.3.30-2· all · bookwormNot affected
nvd · libspring-java · debian · bookworm
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2020-5398]
- [https://security-tracker.debian.org/tracker/CVE-2020-5398]
- [https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-5398.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2024-2181.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]