CVE-2020-5421: Improper Input Validation in Spring Framework
Summary
CVE-2020-5421: Improper Input Validation in Spring Framework. Affects org.springframework:spring-framework-bom across 4 version ranges.
< 4.3.29
>= 5.0.0, < 5.0.19
>= 5.1.0, < 5.1.18
>= 5.2.0, < 5.2.9
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2020-5421 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The framework offers features such as dependency injection, aspect-oriented programming, and MVC architecture. This vulnerability affects versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions of the Spring Framework. The vulnerability allows for the bypassing of protections against RFD (Request Forgery with Redirect) attacks, depending on the browser used and the presence of a jsessionid path parameter.
Vulnerability Detail
The vulnerability arises from improper input validation in the Spring Framework. It specifically affects the protections against RFD attacks from CVE-2015-5211. By exploiting this vulnerability, an attacker can bypass the RFD protections, potentially leading to unauthorized access, data leakage, or other malicious activities. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.3.294.3.29 -
>= 5.0.0, < 5.0.195.0.19 -
>= 5.1.0, < 5.1.185.1.18 -
>= 5.2.0, < 5.2.95.2.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Spring Framework allows for the bypassing of protections against RFD attacks, potentially leading to unauthorized access, data leakage, or other malicious activities. It is recommended to update the framework to the fixed versions mentioned above to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-framework-bom →
FAQ
The vulnerability allows for the bypassing of protections against RFD attacks, potentially leading to unauthorized access, data leakage, or other malicious activities.
Versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions are affected.
Yes, the vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
There are no known exploits for this vulnerability at the moment.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-rv39-3qh7-9v7w/GHSA-rv39-3qh7-9v7w.json
