Yüksek CVSS 7.5

CVE-2020-5398: Spring Framework: siteler arası betik çalıştırma (XSS)

Yayın: 17 Ocak 2020 03:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Özet bilgiler

Ürün: Vmware Spring Framework
CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: %88,32 (yüzdelik 100)
CWE: CWE-79
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
vmware-spring-framework	5.0.0	—	5.0.16
vmware-spring-framework	5.1.0	—	5.1.13
vmware-spring-framework	5.2.0	—	5.2.3
oracle-application-testing-suite	13.3.0.1	13.3.0.1	—
oracle-communications-billing-and-revenue-management-elastic-charging-engine	11.3	11.3	—
oracle-communications-billing-and-revenue-management-elastic-charging-engine	12.0	12.0	—
oracle-communications-cloud-native-core-policy	1.5.0	1.5.0	—
oracle-communications-diameter-signaling-router	8.0.0	8.2.2	—
oracle-communications-element-manager	8.1.1	8.1.1	—
oracle-communications-element-manager	8.2.0	8.2.0	—
oracle-communications-element-manager	8.2.1	8.2.1	—
oracle-communications-policy-management	12.5.0	12.5.0	—
oracle-communications-session-report-manager	8.1.1	8.1.1	—
oracle-communications-session-report-manager	8.2.0	8.2.0	—
oracle-communications-session-report-manager	8.2.1	8.2.1	—
oracle-communications-session-route-manager	8.1.1	8.1.1	—
oracle-communications-session-route-manager	8.2.0	8.2.0	—
oracle-communications-session-route-manager	8.2.1	8.2.1	—
oracle-enterprise-manager-base-platform	13.2.1.0	13.2.1.0	—
oracle-financial-services-regulatory-reporting-with-agilereporter	8.0.9.2.0	8.0.9.2.0	—
oracle-flexcube-private-banking	12.0.0	12.0.0	—
oracle-flexcube-private-banking	12.1.0	12.1.0	—
oracle-healthcare-master-person-index	4.0.2	4.0.2	—
oracle-insurance-calculation-engine	11.0.0	11.3.1	—
oracle-insurance-policy-administration-j2ee	10.2.0	10.2.0	—
oracle-insurance-policy-administration-j2ee	10.2.4	10.2.4	—
oracle-insurance-policy-administration-j2ee	11.0.2	11.0.2	—
oracle-insurance-policy-administration-j2ee	11.1.0	11.1.0	—
oracle-insurance-policy-administration-j2ee	11.2.0	11.2.0	—
oracle-insurance-policy-administration-j2ee	11.2.2.0	11.2.2.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları