CVE-2020-5421: Improper Input Validation in Spring Framework

April 30, 2021 (updated October 21, 2021)

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

References

github.com/advisories/GHSA-rv39-3qh7-9v7w
nvd.nist.gov/vuln/detail/CVE-2020-5421
tanzu.vmware.com/security/cve-2020-5421

Code Behaviors & Features

Detect and mitigate CVE-2020-5421 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →