Critical Vulnerability in libspring-java: Bypass of RFD Protections
Summary
UBUNTU-CVE-2020-5421: In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser... Affects libspring-java versions 3.0.6.RELEASE-10 – 3.0.6.RELEASE-9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a core component of the Spring Framework, widely used for building Java applications. It provides comprehensive infrastructure support for developing Java applications, including features for dependency injection, transaction management, and web application development. However, certain versions of this package are vulnerable to a security flaw that can lead to serious security breaches.
Vulnerability Detail
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against Reflected File Download (RFD) attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter. This vulnerability can allow attackers to exploit the application, potentially leading to unauthorized access to sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider disabling the use of jsessionid path parameters in your application until the package can be updated. This can be done by configuring your web application to use cookies for session management instead.
Conclusion
The vulnerability in libspring-java poses a significant risk to applications using affected versions. It is crucial to update to the latest patched versions to mitigate the risk of exploitation. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libspring-java →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
The affected versions include 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, and 4.3.0 - 4.3.28.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, compromising the security of the application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
