CVE-2020-5397

A flaw was found in springframework. CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints are possible. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials a...

CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

capital.scalable:spring-auto-restdocs-core (>=2.0.8, <=2.0.9), cc.cc4414:cc-spring-cloud-starter-gateway (0.5.1) +246 more potentially affected by CVE-2020-5397 via org.springframework:spring-webflux (>=5.2.0.release, <=5.2.2.release)

org.springframework:spring-webflux MAVEN version =5.2.0.release, =2.0.8, =1.0.0, =1.2.1, =0.5.4, =4.55.12, =4.59.2 - com.github.hetianyi:springboot-ready sb-2.2.2.release-23 - com.github.jchanghong:parent 3.0.11 and more Source cves: CVE-2020-5397 Source advisory: OSV:GHSA-7PM4-G2QJ-J85X...

capital.scalable:spring-auto-restdocs-core (>=2.0.8, <=2.0.9), cc.cc4414:cc-spring-cloud-starter-gateway (0.5.1) +246 more potentially affected by CVE-2020-5397 via org.springframework:spring-webflux (>=5.2.0.release, <=5.2.2.release)

org.springframework:spring-webflux MAVEN version =5.2.0.release, =2.0.8, =1.0.0, =1.2.1, =0.5.4, =4.55.12, =4.59.2 - com.github.hetianyi:springboot-ready sb-2.2.2.release-23 - com.github.jchanghong:parent 3.0.11 and more Source cves: CVE-2020-5397 Source advisory: GHSA-7PM4-G2QJ-J85X...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.21), ai.hyacinth.framework:core-service-gateway-server (>=0.5.0, <=0.5.21) +267 more potentially affected by CVE-2020-5398 via org.springframework:spring-webflux (>=5.1.0.release, <=5.1.12.release)

org.springframework:spring-webflux MAVEN version =5.1.0.release, =0.5.0, =0.5.0, =0.5.0, =2.1.2.release, =0.5.0, =3.1.64, =3.1.37, =3.1.13, =3.1.64, =3.1.64, =3.1.64, =3.1.64, =3.1.64, =3.1.165 and more Source cves: CVE-2020-5398 Source advisory: GHSA-8WX2-9Q48-VM9R...

am.ik.github:reactive-github-client (>=0.0.1, <=0.0.4), capital.scalable:spring-auto-restdocs-core (>=2.0.2, <=2.0.6) +314 more potentially affected by CVE-2020-5398 via org.springframework:spring-webflux (>=5.0.0.release, <=5.0.15.release)

org.springframework:spring-webflux MAVEN version =5.0.0.release, =0.0.1, =2.0.2, =2.0.0, =2.0.0, =3.0.0.release, =3.0.0.release, =b.0.0.1, =b.0.0.1, =b.0.0.1, =b.0.0.1, =2.21.3, =0.1.0-rc5, =1.5.0-alpha2, =1.4.0-alpha4, =1.6.7 and more Source cves: CVE-2020-5398ht...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.21), ai.hyacinth.framework:core-service-gateway-server (>=0.5.0, <=0.5.21) +267 more potentially affected by CVE-2020-5398 via org.springframework:spring-webflux (>=5.1.0.release, <=5.1.12.release)

org.springframework:spring-webflux MAVEN version =5.1.0.release, =0.5.0, =0.5.0, =0.5.0, =2.1.2.release, =0.5.0, =3.1.64, =3.1.37, =3.1.13, =3.1.64, =3.1.64, =3.1.64, =3.1.64, =3.1.64, =3.1.165 and more Source cves: CVE-2020-5398 Source advisory: OSV:GHSA-8WX2-9Q48-VM9R...

capital.scalable:spring-auto-restdocs-core (>=2.0.8, <=2.0.9), cc.cc4414:cc-spring-cloud-starter-gateway (0.5.1) +246 more potentially affected by CVE-2020-5398 via org.springframework:spring-webflux (>=5.2.0.release, <=5.2.2.release)

org.springframework:spring-webflux MAVEN version =5.2.0.release, =2.0.8, =1.0.0, =1.2.1, =0.5.4, =4.55.12, =4.59.2 - com.github.hetianyi:springboot-ready sb-2.2.2.release-23 - com.github.jchanghong:parent 3.0.11 and more Source cves: CVE-2020-5398 Source advisory: OSV:GHSA-8WX2-9Q48-VM9R...

capital.scalable:spring-auto-restdocs-core (>=2.0.8, <=2.0.9), cc.cc4414:cc-spring-cloud-starter-gateway (0.5.1) +246 more potentially affected by CVE-2020-5398 via org.springframework:spring-webflux (>=5.2.0.release, <=5.2.2.release)

org.springframework:spring-webflux MAVEN version =5.2.0.release, =2.0.8, =1.0.0, =1.2.1, =0.5.4, =4.55.12, =4.59.2 - com.github.hetianyi:springboot-ready sb-2.2.2.release-23 - com.github.jchanghong:parent 3.0.11 and more Source cves: CVE-2020-5398 Source advisory: GHSA-8WX2-9Q48-VM9R...

RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download RFD attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from use...

CVE-2020-5397

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

CVE-2020-5397

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

Cross site request forgery (csrf)

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

CVE-2020-5397

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

CVE-2020-5397

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

CVE-2020-5397 CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

CVE-2020-5397: Cross-Site Request Forgery (CSRF)

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

PT-2020-3202

Name of the Vulnerable Software and Affected Versions Spring Framework versions 5.2.x prior to 5.2.3 Description The issue is related to a lack of protection against cross-site request forgery CSRF attacks through CORS preflight requests targeting Spring MVC or Spring WebFlux endpoints. Only...

capital.scalable:spring-auto-restdocs-core (>=2.0.8, <=2.0.9), cc.cc4414:cc-spring-cloud-starter-gateway (0.5.1) +246 more potentially affected by CVE-2020-5398 via org.springframework:spring-webflux (>=5.2.0.release, <=5.2.2.release)

org.springframework:spring-webflux MAVEN version =5.2.0.release, =2.0.8, =1.0.0, =1.2.1, =0.5.4, =4.55.12, =4.59.2 - com.github.hetianyi:springboot-ready sb-2.2.2.release-23 - com.github.jchanghong:parent 3.0.11 and more Source cves: CVE-2020-5398 Source advisory: MEND:CVE-2020-5398...

Denial of service

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...