CVE-2020-5397CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux
Updated under an hour ago ()
Does this affect you?
It affects Spring Framework and 27 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 2.55%, higher than 85% of scored CVEs.
Do this next
Free account, 1 product
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
- CVSS
- 5.3 MEDIUM (v3.0, CNA)CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-352
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 2.55% (percentile 85)
- Assigned by
- pivotal
- NVD analysis
- Modified
- Record last updated
- Sep 17, 2024
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
Spring Spring Framework spring:framework (from the name) | from 5.2 before v5.2.3.RELEASE | CNA record |
vmware spring_framework vmware:spring_framework | from 5.2.0 before 5.2.3 | NVD |
oracle application_testing_suite oracle:application_testing_suite | 13.3.0.1 | NVD |
oracle communications_brm_-_elastic_charging_engine oracle:communications_brm_-_elastic_charging_engine | 11.3; 12.0 | NVD |
oracle communications_diameter_signaling_router oracle:communications_diameter_signaling_router | from 8.0.0 through 8.2.2 | NVD |
oracle communications_element_manager oracle:communications_element_manager | 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle communications_policy_management oracle:communications_policy_management | 12.5.0 | NVD |
oracle communications_session_route_manager oracle:communications_session_route_manager | 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle enterprise_manager_base_platform oracle:enterprise_manager_base_platform | 13.2.1.0 | NVD |
oracle financial_services_regulatory_reporting_with_agilereporter oracle:financial_services_regulatory_reporting_with_agilereporter | 8.0.9.2.0 | NVD |
oracle flexcube_private_banking oracle:flexcube_private_banking | 12.0.0; 12.1.0 | NVD |
oracle healthcare_master_person_index oracle:healthcare_master_person_index | 4.0.2 | NVD |
oracle insurance_calculation_engine oracle:insurance_calculation_engine | from 11.0.0 through 11.3.1 | NVD |
oracle insurance_policy_administration_j2ee oracle:insurance_policy_administration_j2ee | 10.2.0; 10.2.4; 11.0.2; 11.1.0; 11.2.0 | NVD |
oracle insurance_rules_palette oracle:insurance_rules_palette | 10.2.0; 10.2.4; 11.0.2; 11.1.0; 11.2.0 | NVD |
oracle mysql_enterprise_monitor oracle:mysql_enterprise_monitor | from 4.0.0 through 4.0.12; from 8.0.0 through 8.0.20 | NVD |
oracle rapid_planning oracle:rapid_planning | 12.1; 12.2 | NVD |
oracle retail_assortment_planning oracle:retail_assortment_planning | 15.0; 16.0 | NVD |
oracle retail_back_office oracle:retail_back_office | 14.1 | NVD |
oracle retail_central_office oracle:retail_central_office | 14.1 | NVD |
oracle retail_financial_integration oracle:retail_financial_integration | 15.0; 16.0 | NVD |
oracle retail_integration_bus oracle:retail_integration_bus | 15.0.3; 16.0.3 | NVD |
oracle retail_order_broker oracle:retail_order_broker | 15.0; 16.0 | NVD |
oracle retail_point-of-service oracle:retail_point-of-service | 14.1 | NVD |
oracle retail_predictive_application_server oracle:retail_predictive_application_server | 14.0.3; 14.1.3; 15.0.3.0; 16.0.3.0 | NVD |
oracle retail_returns_management oracle:retail_returns_management | 14.1 | NVD |
oracle retail_service_backbone oracle:retail_service_backbone | 15.0; 16.0 | NVD |
oracle weblogic_server oracle:weblogic_server | 12.2.1.3.0; 12.2.1.4.0 | NVD |
References
- https://www.oracle.com/security-alerts/cpuapr2020.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlx-refsource-misc, patch, third-party-advisory
- https://pivotal.io/security/cve-2020-5397x-refsource-confirm, exploit, vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2020.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlx-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.