CVE-2020-5398

Published: Jan 17, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: NVD

Description

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Vulnerable Software	Affected Versions
Vmware Spring Framework	From 5.0.0 to 5.0.16
Vmware Spring Framework	From 5.1.0 to 5.1.13
Vmware Spring Framework	From 5.2.0 to 5.2.3

Vulnerable Software	Affected Versions
Oracle Application Testing Suite	Version 13.3.0.1
Oracle Communications Billing And Revenue Management Elastic Charging Engine	Version 11.3
Oracle Communications Billing And Revenue Management Elastic Charging Engine	Version 12.0
Oracle Communications Cloud Native Core Policy	Version 1.5.0
Oracle Communications Diameter Signaling Router	From 8.0.0 to 8.2.2
Oracle Communications Element Manager	Version 8.1.1
Oracle Communications Element Manager	Version 8.2.0
Oracle Communications Element Manager	Version 8.2.1
Oracle Communications Policy Management	Version 12.5.0
Oracle Communications Session Report Manager	Version 8.1.1
Oracle Communications Session Report Manager	Version 8.2.0
Oracle Communications Session Report Manager	Version 8.2.1
Oracle Communications Session Route Manager	Version 8.1.1
Oracle Communications Session Route Manager	Version 8.2.0
Oracle Communications Session Route Manager	Version 8.2.1
Oracle Enterprise Manager Base Platform	Version 13.2.1.0
Oracle Financial Services Regulatory Reporting With Agilereporter	Version 8.0.9.2.0
Oracle Flexcube Private Banking	Version 12.0.0
Oracle Flexcube Private Banking	Version 12.1.0
Oracle Healthcare Master Person Index	Version 4.0.2
Oracle Insurance Calculation Engine	From 11.0.0 to 11.3.1
Oracle Insurance Policy Administration J2ee	Version 10.2.0
Oracle Insurance Policy Administration J2ee	Version 10.2.4
Oracle Insurance Policy Administration J2ee	Version 11.0.2
Oracle Insurance Policy Administration J2ee	Version 11.1.0
Oracle Insurance Policy Administration J2ee	Version 11.2.0
Oracle Insurance Policy Administration J2ee	Version 11.2.2.0
Oracle Insurance Rules Palette	Version 10.2.0
Oracle Insurance Rules Palette	Version 10.2.4
Oracle Insurance Rules Palette	Version 11.0.2
Oracle Insurance Rules Palette	Version 11.1.0
Oracle Insurance Rules Palette	Version 11.2.0
Oracle Mysql	From 4.0.0 to 4.0.12
Oracle Mysql	From 8.0.0 to 8.0.20
Oracle Rapid Planning	Version 12.1
Oracle Rapid Planning	Version 12.2
Oracle Retail Assortment Planning	Version 15.0
Oracle Retail Assortment Planning	Version 16.0
Oracle Retail Back Office	Version 14.1
Oracle Retail Bulk Data Integration	Version 16.0.3.0
Oracle Retail Central Office	Version 14.1
Oracle Retail Financial Integration	Version 15.0
Oracle Retail Financial Integration	Version 16.0
Oracle Retail Integration Bus	Version 15.0.3
Oracle Retail Integration Bus	Version 16.0.3
Oracle Retail Order Broker	Version 15.0
Oracle Retail Order Broker	Version 16.0
Oracle Retail Point Of Service	Version 14.1
Oracle Retail Predictive Application Server	Version 14.0.3
Oracle Retail Predictive Application Server	Version 14.1.3.0
Oracle Retail Predictive Application Server	Version 15.0.3
Oracle Retail Predictive Application Server	Version 16.0.3.0
Oracle Retail Returns Management	Version 14.1
Oracle Retail Service Backbone	Version 15.0
Oracle Retail Service Backbone	Version 16.0
Oracle Siebel Engineering Installer & Deployment	Up to 2.1.1
Oracle Weblogic Server	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.2.1.4.0

Vulnerable Software	Affected Versions
Netapp Data Availability Services	All versions
Netapp Snapcenter	All versions

CVE-2020-5398

Description

Affected (63)

Related CWEs

References (88)

Timeline