~ / search / GHSA-8wx2-9q48-vm9r

GHSA-8wx2-9q48-vm9r

RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

Source: GitHub Advisory Database (reviewed) High CVE-2020-5398

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework:spring-webmvc >= 5.2.0.RELEASE, < 5.2.3.RELEASE 5.2.3.RELEASE
Maven org.springframework:spring-webmvc >= 5.1.0.RELEASE, < 5.1.13.RELEASE 5.1.13.RELEASE
Maven org.springframework:spring-webmvc >= 5.0.0.RELEASE, < 5.0.16.RELEASE 5.0.16.RELEASE
Maven org.springframework:spring-webflux >= 5.2.0.RELEASE, < 5.2.3.RELEASE 5.2.3.RELEASE
Maven org.springframework:spring-webflux >= 5.1.0.RELEASE, < 5.1.13.RELEASE 5.1.13.RELEASE
Maven org.springframework:spring-webflux >= 5.0.0.RELEASE, < 5.0.16.RELEASE 5.0.16.RELEASE

Details

As written in the advisory (Markdown source, shown as plain text).

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

References

External links from the advisory. They lead to third-party sites.