Back to CVE records
High 8.0HealthcarePublished Jan 16, 2020
CVE-2020-5398RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
Updated under an hour ago ()
Does this affect you?
It affects Spring Framework and 33 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 88.77%, higher than 100% of scored CVEs. That is high: schedule it on your emergency patch path.
Do this next
Start free and add your stack
Free account, 1 product
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
- CVSS
- 8.0 HIGH (v3.0, CNA)CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 88.77% (percentile 100)
- Assigned by
- pivotal
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Spring Spring Framework spring:framework (from the name) | from 5.0 before v5.0.16.RELEASE; from 5.1 before v5.1.13.RELEASE; from 5.2 before v5.2.3.RELEASE | CNA record |
vmware spring_framework vmware:spring_framework | from 5.0.0 before 5.0.16; from 5.1.0 before 5.1.13; from 5.2.0 before 5.2.3 | NVD |
oracle application_testing_suite oracle:application_testing_suite | 13.3.0.1 | NVD |
oracle communications_billing_and_revenue_management_elastic_charging_engine oracle:communications_billing_and_revenue_management_elastic_charging_engine | 11.3; 12.0 | NVD |
oracle communications_cloud_native_core_policy oracle:communications_cloud_native_core_policy | 1.5.0 | NVD |
oracle communications_diameter_signaling_router oracle:communications_diameter_signaling_router | from 8.0.0 through 8.2.2 | NVD |
oracle communications_element_manager oracle:communications_element_manager | 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle communications_policy_management oracle:communications_policy_management | 12.5.0 | NVD |
oracle communications_session_report_manager oracle:communications_session_report_manager | 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle communications_session_route_manager oracle:communications_session_route_manager | 8.1.1; 8.2.0; 8.2.1 | NVD |
oracle enterprise_manager_base_platform oracle:enterprise_manager_base_platform | 13.2.1.0 | NVD |
oracle financial_services_regulatory_reporting_with_agilereporter oracle:financial_services_regulatory_reporting_with_agilereporter | 8.0.9.2.0 | NVD |
oracle flexcube_private_banking oracle:flexcube_private_banking | 12.0.0; 12.1.0 | NVD |
oracle healthcare_master_person_index oracle:healthcare_master_person_index | 4.0.2 | NVD |
oracle insurance_calculation_engine oracle:insurance_calculation_engine | from 11.0.0 through 11.3.1 | NVD |
oracle insurance_policy_administration_j2ee oracle:insurance_policy_administration_j2ee | 10.2.0; 10.2.4; 11.0.2; 11.1.0; 11.2.0; 11.2.2.0 | NVD |
oracle insurance_rules_palette oracle:insurance_rules_palette | 10.2.0; 10.2.4; 11.0.2; 11.1.0; 11.2.0 | NVD |
oracle mysql oracle:mysql | from 4.0.0 through 4.0.12; from 8.0.0 through 8.0.20 | NVD |
oracle rapid_planning oracle:rapid_planning | 12.1; 12.2 | NVD |
oracle retail_assortment_planning oracle:retail_assortment_planning | 15.0; 16.0 | NVD |
oracle retail_back_office oracle:retail_back_office | 14.1 | NVD |
oracle retail_bulk_data_integration oracle:retail_bulk_data_integration | 16.0.3.0 | NVD |
oracle retail_central_office oracle:retail_central_office | 14.1 | NVD |
oracle retail_financial_integration oracle:retail_financial_integration | 15.0; 16.0 | NVD |
oracle retail_integration_bus oracle:retail_integration_bus | 15.0.3; 16.0.3 | NVD |
oracle retail_order_broker oracle:retail_order_broker | 15.0; 16.0 | NVD |
oracle retail_point-of-service oracle:retail_point-of-service | 14.1 | NVD |
oracle retail_predictive_application_server oracle:retail_predictive_application_server | 14.0.3; 14.1.3.0; 15.0.3; 16.0.3.0 | NVD |
oracle retail_returns_management oracle:retail_returns_management | 14.1 | NVD |
oracle retail_service_backbone oracle:retail_service_backbone | 15.0; 16.0 | NVD |
oracle siebel_engineering_-_installer_&_deployment oracle:siebel_engineering_-_installer_&_deployment | through 2.1.1 | NVD |
oracle weblogic_server oracle:weblogic_server | 12.2.1.3.0; 12.2.1.4.0 | NVD |
netapp data_availability_services netapp:data_availability_services | all versions | NVD |
netapp snapcenter netapp:snapcenter | all versions | NVD |
References
- https://lists.apache.org/thread.html/rf8dc72b974ee74f17bce661ea7d124e733a1f4c4f236354ac0cf48e8%40%3Ccommits.camel.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rc05acaacad089613e9642f939b3a44f7199b5537493945c3e045287f%40%3Cdev.geode.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rdcaadaa9a68b31b7d093d76eacfaacf6c7a819f976b595c75ad2d4dc%40%3Cdev.geode.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r7361bfe84bde9d233f9800c3a96673e7bd81207549ced0236f07a29d%40%3Cissues.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r9fb1ee08cf337d16c3364feb0f35a072438c1a956afd7b77859aa090%40%3Cissues.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r0f3530f7cb510036e497532ffc4e0bd0b882940448cf4e233994b08b%40%3Ccommits.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r8736185eb921022225a83e56d7285a217fd83f5524bd64a6ca3bf5cc%40%3Cissues.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r7d5e518088e2e778928b02bcd3be3b948b59acefe2f0ebb57ec2ebb0%40%3Ccommits.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r3765353ff434fd00d8fa5a44734b3625a06eeb2a3fb468da7dfae134%40%3Ccommits.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rab0de39839b4c208dcd73f01e12899dc453361935a816a784548e048%40%3Cissues.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r1bc5d673c01cfbb8e4a91914e9748ead3e5f56b61bca54d314c0419b%40%3Cissues.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r4b1886e82cc98ef38f582fef7d4ea722e3fcf46637cd4674926ba682%40%3Cissues.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/reaa8a6674baf2724b1b88a621b0d72d9f7a6f5577c88759842c16eb6%40%3Ccommits.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r74f81f93a9b69140fe41e236afa7cbe8dfa75692e7ab31a468fddaa0%40%3Ccommits.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r028977b9b9d44a89823639aa3296fb0f0cfdd76b4450df89d3c4fbbf%40%3Cissues.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r2dfd5b331b46d3f90c4dd63a060e9f04300468293874bd7e41af7163%40%3Cissues.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r8cc37a60a5056351377ee5f1258f2a4fdd39822a257838ba6bcc1e88%40%3Ccommits.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r1accbd4f31ad2f40e1661d70a4510a584eb3efd1e32e8660ccf46676%40%3Ccommits.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rb4d1fc078f086ec2e98b2693e8b358e58a6a4ef903ceed93a1ee2b18%40%3Ccommits.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r6dac0e365d1b2df9a7ffca12b4195181ec14ff0abdf59e1fdb088ce5%40%3Ccommits.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r4639e821ef9ca6ca10887988f410a60261400a7766560e7a97a22efc%40%3Ccommits.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r0f2d0ae1bad2edb3d4a863d77f3097b5e88cfbdae7b809f4f42d6aad%40%3Cissues.karaf.apache.org%3Emailing-list, x-refsource-mlist
- https://www.oracle.com/security-alerts/cpuapr2020.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpujul2020.htmlx-refsource-misc
- https://pivotal.io/security/cve-2020-5398x-refsource-confirm
- https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163%40%3Ccommits.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a%40%3Cissues.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r27552d2fa10d96f2810c50d16ad1fd1899e37796c81a0c5e7585a02d%40%3Cdev.rocketmq.apache.org%3E
- https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5%40%3Cissues.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r645408661a8df9158f49e337072df39838fa76da629a7e25a20928a6%40%3Cdev.rocketmq.apache.org%3E
- https://lists.apache.org/thread.html/r712a6fce928e24e7b6ec30994a7e115a70f1f6e4cf2c2fbf0347ce46%40%3Ccommits.servicecomb.apache.org%3E
- https://lists.apache.org/thread.html/r881fb5a95ab251106fed38f836257276feb026bfe01290e72ff91c2a%40%3Ccommits.servicecomb.apache.org%3E
- https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a%40%3Cdev.ambari.apache.org%3E
- https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1%40%3Cdev.ambari.apache.org%3E
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.