← CVE Intelligence

CVE-2020-5398

RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application PUBLISHED

Description (CNA)

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Affected (CNA)

Vendor / productVersions
Spring / Spring Frameworkaffected 5.0 before v5.0.16.RELEASE; affected 5.1 before v5.1.13.RELEASE; affected 5.2 before v5.2.3.RELEASE

CWE

CWE-79

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.