~ / search / GHSA-rv39-3qh7-9v7w

GHSA-rv39-3qh7-9v7w

Improper Input Validation in Spring Framework

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-5421

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework:spring-framework-bom >= 5.2.0, < 5.2.9 5.2.9
Maven org.springframework:spring-framework-bom >= 5.1.0, < 5.1.18 5.1.18
Maven org.springframework:spring-framework-bom >= 5.0.0, < 5.0.19 5.0.19
Maven org.springframework:spring-framework-bom < 4.3.29 4.3.29

Details

As written in the advisory (Markdown source, shown as plain text).

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

References

External links from the advisory. They lead to third-party sites.