Back to CVE records
High 8.7HealthcarePublished Sep 19, 2020
CVE-2020-5421RFD Protection Bypass via jsessionid
Updated under an hour ago ()
Does this affect you?
It affects Spring by VMware Spring Framework and 38 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 11.56%, higher than 96% of scored CVEs. That is high: schedule it on your emergency patch path.
Do this next
Start free and add your stack
Free account, 1 product
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
- CVSS
- 8.7 HIGH (v3.0, CNA)CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- Weakness (CWE)
- CWE-020
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 11.56% (percentile 96)
- Assigned by
- pivotal
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Spring by VMware Spring Framework spring_by_vmware:spring_framework (from the name) | from 4.3 before 4.3.29; from 5.0 before 5.0.19; from 5.1 before 5.1.18; from 5.2 before 5.2.9 | CNA record |
vmware spring_framework vmware:spring_framework | before 4.3.29; from 5.0.0 before 5.0.19; from 5.1.0 before 5.1.18; from 5.2.0 before 5.2.9 | NVD |
oracle commerce_guided_search oracle:commerce_guided_search | 11.3.2 | NVD |
oracle communications_brm oracle:communications_brm | 11.3.0.9; 12.0.0.3 | NVD |
oracle communications_design_studio oracle:communications_design_studio | 7.3.4; 7.3.5; 7.4.0 | NVD |
oracle communications_session_report_manager oracle:communications_session_report_manager | from 8.2.1 through 8.2.2.1 | NVD |
oracle communications_unified_inventory_management oracle:communications_unified_inventory_management | 7.3.4; 7.3.5 | NVD |
oracle endeca_information_discovery_integrator oracle:endeca_information_discovery_integrator | 3.2.0 | NVD |
oracle enterprise_data_quality oracle:enterprise_data_quality | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle financial_services_analytical_applications_infrastructure oracle:financial_services_analytical_applications_infrastructure | from 8.0.6 through 8.1.0 | NVD |
oracle flexcube_private_banking oracle:flexcube_private_banking | 12.0.0; 12.1.0 | NVD |
oracle fusion_middleware oracle:fusion_middleware | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle goldengate_application_adapters oracle:goldengate_application_adapters | 19.1.0.0.0 | NVD |
oracle healthcare_master_person_index oracle:healthcare_master_person_index | 4.0.2.5 | NVD |
oracle hyperion_infrastructure_technology oracle:hyperion_infrastructure_technology | 11.1.2.4 | NVD |
oracle insurance_policy_administration oracle:insurance_policy_administration | from 11.1.0 through 11.3.0; 10.2; 10.2.4; 11.0.2 | NVD |
oracle insurance_rules_palette oracle:insurance_rules_palette | from 11.1.0 through 11.3.0; 10.2.0; 10.2.4; 11.0.2 | NVD |
oracle mysql_enterprise_monitor oracle:mysql_enterprise_monitor | through 8.0.22; 8.0.23 | NVD |
oracle primavera_gateway oracle:primavera_gateway | from 16.2.0 through 16.2.11; from 17.12.0 through 17.12.9; from 18.8.0 through 18.8.10; from 19.12.0 through 19.12.10 | NVD |
oracle primavera_p6_enterprise_project_portfolio_management oracle:primavera_p6_enterprise_project_portfolio_management | from 16.1.0 through 16.2.20; from 17.1.0 through 17.12.19; from 18.1.0 through 18.8.21; from 19.12.0 through 19.12.10 | NVD |
oracle retail_assortment_planning oracle:retail_assortment_planning | 16.0.3.0 | NVD |
oracle retail_bulk_data_integration oracle:retail_bulk_data_integration | 16.0.3.0 | NVD |
oracle retail_customer_engagement oracle:retail_customer_engagement | from 16.0 through 19.0 | NVD |
oracle retail_customer_management_and_segmentation_foundation oracle:retail_customer_management_and_segmentation_foundation | from 16.0 through 19.0 | NVD |
oracle retail_financial_integration oracle:retail_financial_integration | 14.1.3; 15.0.3; 16.0.3 | NVD |
oracle retail_integration_bus oracle:retail_integration_bus | 14.1.3; 15.0.3; 16.0.3 | NVD |
oracle retail_invoice_matching oracle:retail_invoice_matching | 14.0; 14.1 | NVD |
oracle retail_merchandising_system oracle:retail_merchandising_system | 16.0.3 | NVD |
oracle retail_order_broker oracle:retail_order_broker | 15.0; 16.0 | NVD |
oracle retail_predictive_application_server oracle:retail_predictive_application_server | 14.1 | NVD |
oracle retail_returns_management oracle:retail_returns_management | 14.1 | NVD |
oracle retail_service_backbone oracle:retail_service_backbone | 14.1.3; 15.0.3; 16.0.3 | NVD |
oracle retail_xstore_point_of_service oracle:retail_xstore_point_of_service | 15.0.4; 16.0.6; 17.0.4; 18.0.3; 19.0.2 | NVD |
oracle storagetek_acsls oracle:storagetek_acsls | 8.5.1 | NVD |
oracle storagetek_tape_analytics_sw_tool oracle:storagetek_tape_analytics_sw_tool | 2.3 | NVD |
oracle weblogic_server oracle:weblogic_server | 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 | NVD |
netapp oncommand_insight netapp:oncommand_insight | all versions | NVD |
netapp snap_creator_framework netapp:snap_creator_framework | all versions | NVD |
netapp snapcenter netapp:snapcenter | all versions | NVD |
References
- https://tanzu.vmware.com/security/cve-2020-5421x-refsource-confirm, vendor-advisory
- https://lists.apache.org/thread.html/re014a49d77f038ba70e5e9934d400af6653e8c9ac110d32b1254127e%40%3Cdev.ranger.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a%40%3Cissues.ambari.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1%40%3Cdev.ambari.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a%40%3Cdev.ambari.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163%40%3Ccommits.ambari.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5%40%3Cissues.ambari.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rf00d8f4101a1c1ea4de6ea1e09ddf7472cfd306745c90d6da87ae074%40%3Cdev.hive.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rc9efaf6db98bee19db1bc911d0fa442287dac5cb229d4aaa08b6a13d%40%3Cissues.hive.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r7e6a213eea7f04fc6d9e3bd6eb8d68c4df92a22e956e95cb2c482865%40%3Cissues.hive.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r503e64b43a57fd68229cac4a869d1a9a2eac9e75f8719cad3a840211%40%3Ccommits.pulsar.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r918caad55dcc640a16753b00d8d6acb90b4e36de4b6156d0867246ec%40%3Ccommits.pulsar.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/r3589ed0d18edeb79028615080d5a0e8878856436bb91774a3196d9eb%40%3Ccommits.pulsar.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rb18ed999153ef0f0cb7af03efe0046c42c7242fd77fbd884a75ecfdc%40%3Ccommits.pulsar.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/raf7ca57033e537e4f9d7df7f192fa6968c1e49409b2348e08d807ccb%40%3Cuser.ignite.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/ra889d95141059c6cbe77dd80249bb488ae53b274b5f3abad09d9511d%40%3Cuser.ignite.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/rd462a8b0dfab4c15e67c0672cd3c211ecd0e4f018f824082ed54f665%40%3Cissues.hive.apache.org%3Emailing-list, x-refsource-mlist
- https://www.oracle.com/security-alerts/cpujan2021.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlx-refsource-misc, patch, third-party-advisory
- https://security.netapp.com/advisory/ntap-20210513-0009/x-refsource-confirm, third-party-advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlx-refsource-misc, not-applicable, third-party-advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlx-refsource-misc, patch, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.