high
8
CWE
494 79
Advisory Published
Advisory Published
Updated

CVE-2020-5398: RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

First published: Thu Jan 16 2020(Updated: )

A flaw was found in springframework in versions prior to 5.0.16, 5.1.13, and 5.2.3. A reflected file download (RFD) attack is possible when a "Content-Disposition" header is set in response to where the filename attribute is derived from user supplied input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Credit: security@pivotal.io security@pivotal.io

Affected SoftwareAffected VersionHow to fix
redhat/springframework<5.2.3
5.2.3
redhat/springframework<5.1.13
5.1.13
redhat/springframework<5.0.16
5.0.16
maven/org.springframework:spring-webflux>=5.0.0.RELEASE<5.0.16.RELEASE
5.0.16.RELEASE
maven/org.springframework:spring-webflux>=5.1.0.RELEASE<5.1.13.RELEASE
5.1.13.RELEASE
maven/org.springframework:spring-webflux>=5.2.0.RELEASE<5.2.3.RELEASE
5.2.3.RELEASE
maven/org.springframework:spring-webmvc>=5.0.0.RELEASE<5.0.16.RELEASE
5.0.16.RELEASE
maven/org.springframework:spring-webmvc>=5.1.0.RELEASE<5.1.13.RELEASE
5.1.13.RELEASE
maven/org.springframework:spring-webmvc>=5.2.0.RELEASE<5.2.3.RELEASE
5.2.3.RELEASE
IBM Data Risk Manager<=2.0.6
Spring Framework>=5.0.0<5.0.16
Spring Framework>=5.1.0<5.1.13
Spring Framework>=5.2.0<5.2.3
Oracle Application Testing Suite=13.3.0.1
oracle communications billing and revenue management elastic charging engine=11.3
oracle communications billing and revenue management elastic charging engine=12.0
oracle communications Cloud native core policy=1.5.0
Oracle Communications Diameter Signaling Router>=8.0.0<=8.2.2
oracle communications element manager=8.1.1
oracle communications element manager=8.2.0
oracle communications element manager=8.2.1
Oracle Communications Policy Management=12.5.0
oracle communications session report manager=8.1.1
oracle communications session report manager=8.2.0
oracle communications session report manager=8.2.1
oracle communications session route manager=8.1.1
oracle communications session route manager=8.2.0
oracle communications session route manager=8.2.1
Oracle Enterprise Manager Base Platform=13.2.1.0
Oracle Financial Services Compliance Regulatory Reporting=8.0.9.2.0
Oracle FLEXCUBE Private Banking=12.0.0
Oracle FLEXCUBE Private Banking=12.1.0
Oracle Healthcare Master Person Index=4.0.2
Oracle Insurance Calculation Engine>=11.0.0<=11.3.1
Oracle Insurance Policy Administration J2EE=10.2.0
Oracle Insurance Policy Administration J2EE=10.2.4
Oracle Insurance Policy Administration J2EE=11.0.2
Oracle Insurance Policy Administration J2EE=11.1.0
Oracle Insurance Policy Administration J2EE=11.2.0
Oracle Insurance Policy Administration J2EE=11.2.2.0
Oracle Insurance Rules Palette=10.2.0
Oracle Insurance Rules Palette=10.2.4
Oracle Insurance Rules Palette=11.0.2
Oracle Insurance Rules Palette=11.1.0
Oracle Insurance Rules Palette=11.2.0
MySQL>=4.0.0<=4.0.12
MySQL>=8.0.0<=8.0.20
Oracle Rapid Planning=12.1
Oracle Rapid Planning=12.2
Oracle Retail Assortment Planning=15.0
Oracle Retail Assortment Planning=16.0
Oracle Retail Back Office=14.1
Oracle Retail Bulk Data Integration=16.0.3.0
Oracle Retail Central Office=14.1
oracle retail financial integration=15.0
oracle retail financial integration=16.0
Oracle Retail Integration Bus=15.0.3
Oracle Retail Integration Bus=16.0.3
Oracle Retail Order Broker=15.0
Oracle Retail Order Broker=16.0
Oracle Retail Point-of-Sale=14.1
Oracle Retail Predictive Application Server=14.0.3
Oracle Retail Predictive Application Server=14.1.3.0
Oracle Retail Predictive Application Server=15.0.3
Oracle Retail Predictive Application Server=16.0.3.0
Oracle Retail Returns Management=14.1
Oracle Retail Service Backbone=15.0
Oracle Retail Service Backbone=16.0
Oracle Siebel Engineering - Installer & Deployment<=2.1.1
Oracle WebLogic Server=12.2.1.3.0
Oracle WebLogic Server=12.2.1.4.0
netapp data availability services
NetApp SnapCenter

Remedy

https://www.oracle.com//security-alerts/cpujul2021.html

Remedy

https://www.oracle.com/security-alerts/cpuApr2021.html

Remedy

https://www.oracle.com/security-alerts/cpuoct2021.html

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the severity of CVE-2020-5398?

    The severity of CVE-2020-5398 is considered to be important.

  • How do I fix CVE-2020-5398?

    To fix CVE-2020-5398, you need to upgrade to Spring Framework versions 5.0.16, 5.1.13, or 5.2.3.

  • What is the impact of CVE-2020-5398?

    CVE-2020-5398 allows for a reflected file download (RFD) attack due to insufficient validation of user-supplied input in the 'Content-Disposition' header.

  • Which Spring Framework versions are affected by CVE-2020-5398?

    CVE-2020-5398 affects Spring Framework versions prior to 5.0.16, 5.1.13, and 5.2.3.

  • Is there a patch available for CVE-2020-5398?

    Yes, patches for CVE-2020-5398 are available in the fixed versions of Spring Framework.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203