ROOT-APP-MAVEN-CVE-2015-5211 CVE-2015-5211 in org.springframework:spring-core - Patched by Root

Root has patched CVE-2015-5211 in the org.springframework:spring-core package for Root:Maven. Multiple fixed versions available...

CVE-2015-5211

creationtimestamp| type| source ---|---|--- 2026-10-04 13:00:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mx2hg2pzs424...

Improper Input Validation in Spring Framework

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter...

GHSA-RV39-3QH7-9V7W Improper Input Validation in Spring Framework

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter...

Design/Logic Flaw

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter...

CVE-2020-5421: Undefined Security Weakness

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter...

CVE-2020-5421

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter...

Debian: Security Advisory (DLA-1853-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1853-1] libspring-java security update

Package : libspring-java Version : 3.0.6.RELEASE-17+deb8u1 CVE ID : CVE-2014-3578 CVE-2014-3625 CVE-2015-3192 CVE-2015-5211 CVE-2016-9878 Debian Bug : 760733 769698 796137 849167 Vulnerabilities have been identified in libspring-java, a modular Java/J2EE application framework. CVE-2014-3578 A...

at.chrl:chrl-jms (1.1.0), at.chrl:chrl-orm-spring-integration (1.1.0) +594 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (>=4.2.0.release, <=4.2.1.release)

org.springframework:spring-core MAVEN version =4.2.0.release, =1.0.0, =4.0.beta2, =0.15.0, =0.13.2, =0.13.2, =1.0.6, =1.1.0, =1.0.109-release, =1.0.109-release, =1.0.109-release, =1.0.109-release, =1.0.120-release and more Source cves: CVE-2015-5211 Source advisory: GHSA-PGF9-H69P-PCGF...

com.mysema.web:webmin (0.2.3), com.smartitengineering:smart-hibernate-abstract-dao (0.2) +81 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (2.0.7)

org.springframework:spring-core MAVEN version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.mysema.web:webmin 0.2.3 - com.smartitengineering:smart-hibernate-abstract-dao 0.2 -...

org.acegisecurity:acegi-security (1.0.4), org.acegisecurity:acegi-security-adapters (1.0.4) +34 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (2.0.4)

org.springframework:spring-core MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.acegisecurity:acegi-security 1.0.4 - org.acegisecurity:acegi-security-adapters 1.0.4 -...

be.hikage:spring-template (>=0.3, <=0.4), com.digitalpebble.behemoth:behemoth-gate (>=1.0, <=1.1) +180 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (2.0.8)

org.springframework:spring-core MAVEN version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - be.hikage:spring-template =0.3, =1.0, =1.5, =1.0.0, =2.1.5, =1.0.0, =1.0.1, =0.3, =0.1, =0.1,...

au.com.centrumsystems:build-pipeline-plugin (1.0), ch.ethz.origo:origo-issue-notifier (1.0) +1113 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (2.5)

org.springframework:spring-core MAVEN version 2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - au.com.centrumsystems:build-pipeline-plugin 1.0 - ch.ethz.origo:origo-issue-notifier 1.0 -...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +150 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (2.5.1)

org.springframework:spring-core MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - br.net.woodstock.rockframework:rockframework-domain =1.2.1, =1.2.1, =0.7, =1.3, =2.0, =2.0, =0.0....

com.browseengine.bobo:bobo-browse (>=3.2.0, <=4.0.2), com.browseengine.bobo:bobo-solr (3.2.0) +435 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (2.5.5)

org.springframework:spring-core MAVEN version 2.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.browseengine.bobo:bobo-browse =3.2.0, =0.2.0, =0.0.2, =0.1.9, =0.1.3, =0.6.0, =0.7.8, =0.6.0,...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.6), appscanstandard-integration:ibm-security-appscanstandard-scanner (>=1.0, <=2.8) +1420 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (2.5.6.sec03)

org.springframework:spring-core MAVEN version 2.5.6.sec03 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - aendter.jenkins.plugins:filesystem-list-parameter-plugin =0.0.1, =1.0, =1.0, =0.0.1, =0.1.1...

ar.com.fdvs:dynamicjasper (>=5.0.9, <=5.1.0), ar.com.jmfsg:api-doc (>=0.0.20, <=0.0.34) +6535 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (>=3.0.0.release, <=3.2.14.release)

org.springframework:spring-core MAVEN version =3.0.0.release, =5.0.9, =0.0.20, =1.1.0.release, =1.0.0-alpha-1, =0.3.3, =1.0, =1.0, =0.7, =3.0.beta1, =0.1, =2.1.7, =2.0-beta1, =1.1.1, =1.0.2, =1.1.2 and more Source cves: CVE-2015-5211 Source advisory: GHSA-PGF9-H69P-PCGF...

ai.minxiao:ds4s-cdl4j_2.11 (>=0.1.0, <=0.1.2), am.ik.springmvc:new-controller (>=0.1.0, <=0.2.0) +4511 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (>=4.0.0.release, <=4.1.7.release)

org.springframework:spring-core MAVEN version =4.0.0.release, =0.1.0, =0.1.0, =1.0.0-alpha-3, =0.2, =1.3.1-release, =1.0, =2.2.0, =2.4.0, =2.4.3 and more Source cves: CVE-2015-5211 Source advisory: OSV:GHSA-PGF9-H69P-PCGF...

ai.minxiao:ds4s-cdl4j_2.11 (>=0.1.0, <=0.1.2), am.ik.springmvc:new-controller (>=0.1.0, <=0.2.0) +4511 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (>=4.0.0.release, <=4.1.7.release)

org.springframework:spring-core MAVEN version =4.0.0.release, =0.1.0, =0.1.0, =1.0.0-alpha-3, =0.2, =1.3.1-release, =1.0, =2.2.0, =2.4.0, =2.4.3 and more Source cves: CVE-2015-5211 Source advisory: GHSA-PGF9-H69P-PCGF...