8

CVE-2020-5398

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Data is provided by the National Vulnerability Database (NVD)
VMware ≫ Spring Framework Version >= 5.0.0 < 5.0.16
VMware ≫ Spring Framework Version >= 5.1.0 < 5.1.13
VMware ≫ Spring Framework Version >= 5.2.0 < 5.2.3
Oracle ≫ Application Testing Suite Version13.3.0.1
Oracle ≫ Communications Diameter Signaling Router Version >= 8.0.0 <= 8.2.2
Oracle ≫ Flexcube Private Banking Version12.0.0
Oracle ≫ Flexcube Private Banking Version12.1.0
Oracle ≫ Insurance Calculation Engine Version >= 11.0.0 <= 11.3.1
Oracle ≫ Insurance Rules Palette Version10.2.0
Oracle ≫ Insurance Rules Palette Version10.2.4
Oracle ≫ Insurance Rules Palette Version11.0.2
Oracle ≫ Insurance Rules Palette Version11.1.0
Oracle ≫ Insurance Rules Palette Version11.2.0
Oracle ≫ Mysql Version >= 4.0.0 <= 4.0.12
Oracle ≫ Mysql Version >= 8.0.0 <= 8.0.20
Oracle ≫ Rapid Planning Version12.1
Oracle ≫ Rapid Planning Version12.2
Oracle ≫ Retail Back Office Version14.1
Oracle ≫ Retail Bulk Data Integration Version16.0.3.0
Oracle ≫ Retail Central Office Version14.1
Oracle ≫ Retail Integration Bus Version15.0.3
Oracle ≫ Retail Integration Bus Version16.0.3
Oracle ≫ Retail Order Broker Version15.0
Oracle ≫ Retail Order Broker Version16.0
Oracle ≫ Weblogic Server Version12.2.1.3.0
Oracle ≫ Weblogic Server Version12.2.1.4.0
Netapp ≫ Snapcenter Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 90.57% 0.996
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 7.6 4.9 10
AV:N/AC:H/Au:N/C:C/I:C/A:C
security@pivotal.io 8 1.3 6
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE-494 Download of Code Without Integrity Check

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.