Back
CVE-2020-5398RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
- 8.0HighCVSS base score
- 88.3%Exploitation in 30 daysEPSS · top 0.2% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Timeline
ID reserved
By pivotal
- 13 days later
· 13 days later
Published
- 7 years later
· 7 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| pivotalCNA (assigner) | 3.0 | High8.0 | CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 88.3% · top 0.2% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.0.
Affected products
- affected 5.0 – < v5.0.16.RELEASE
- affected 5.1 – < v5.1.13.RELEASE
- affected 5.2 – < v5.2.3.RELEASE
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.springframework:spring-webfluxGHSA-8wx2-9q48-vm9r (opens in a new tab)
- Mavenorg.springframework:spring-webmvcGHSA-8wx2-9q48-vm9r (opens in a new tab)
References
References44
- [camel-commits] 20200220 [camel] branch camel-2.25.x updated: Updating Spring due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [geode-dev] 20200410 Proposal to bring GEODE-7970 to support/1.12 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [geode-dev] 20200410 Re: Proposal to bring GEODE-7970 to support/1.12 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-issues] 20200514 [jira] [Created] (KARAF-6721) Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-issues] 20200514 [jira] [Commented] (KARAF-6721) Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-commits] 20200514 [GitHub] [karaf] coheigea opened a new pull request #1118: KARAF-6721 - Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-issues] 20200514 [jira] [Updated] (KARAF-6721) Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-commits] 20200514 [GitHub] [karaf] skitt commented on a change in pull request #1118: KARAF-6721 - Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-commits] 20200514 [GitHub] [karaf] coheigea commented on a change in pull request #1118: KARAF-6721 - Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-issues] 20200517 [jira] [Updated] (KARAF-6721) Upgrade to Spring 5.1.14.RELEASE and 5.2.5.RELEASE due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-issues] 20200517 [jira] [Assigned] (KARAF-6721) Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-issues] 20200517 [jira] [Updated] (KARAF-6721) Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-commits] 20200517 [GitHub] [karaf] jbonofre commented on pull request #1118: KARAF-6721 - Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-commits] 20200517 [GitHub] [karaf] jbonofre commented on a change in pull request #1118: KARAF-6721 - Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-issues] 20200517 [jira] [Commented] (KARAF-6721) Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-issues] 20200518 [jira] [Commented] (KARAF-6721) Upgrade to Spring 5.1.14.RELEASE and 5.2.5.RELEASE due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-commits] 20200518 [GitHub] [karaf] jbonofre commented on pull request #1118: KARAF-6721 - Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-commits] 20200518 [GitHub] [karaf] jbonofre removed a comment on pull request #1118: KARAF-6721 - Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-commits] 20200518 [GitHub] [karaf] jbonofre merged pull request #1118: KARAF-6721 - Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-commits] 20200518 [karaf] branch karaf-4.2.x updated: KARAF-6721 - Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-commits] 20200518 [karaf] branch master updated: KARAF-6721 - Update Spring versions due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [karaf-issues] 20200518 [jira] [Resolved] (KARAF-6721) Upgrade to Spring 5.1.14.RELEASE and 5.2.5.RELEASE due to CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://www.oracle.com/security-alerts/cpuapr2020.html (opens in a new tab)x_refsource_MISCx_transferred
- https://www.oracle.com/security-alerts/cpujul2020.html (opens in a new tab)x_refsource_MISCx_transferred
- https://pivotal.io/security/cve-2020-5398 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://lists.apache.org/thread.html/r712a6fce928e24e7b6ec30994a7e115a70f1f6e4cf2c2fbf0347ce46%40%3Ccommits.servicecomb.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
- https://lists.apache.org/thread.html/ra996b56e1f5ab2fed235a8b91fa0cc3cf34c2e9fee290b7fa4380a0d%40%3Ccommits.servicecomb.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
- https://lists.apache.org/thread.html/r881fb5a95ab251106fed38f836257276feb026bfe01290e72ff91c2a%40%3Ccommits.servicecomb.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
- [ambari-issues] 20201013 [jira] [Created] (AMBARI-25571) Vulnerable Spring components in Ambari - CVE-2020-5398, CVE-2020-5421 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [ambari-dev] 20201019 [GitHub] [ambari] dlysnichenko opened a new pull request #3246: AMBARI-25571. Vulnerable Spring components in Ambari - CVE-2020-5398, CVE-2020-5421 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [ambari-dev] 20201019 [GitHub] [ambari] dlysnichenko merged pull request #3246: AMBARI-25571. Vulnerable Spring components in Ambari - CVE-2020-5398, CVE-2020-5421 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [ambari-commits] 20201019 [ambari] branch branch-2.7 updated: AMBARI-25571. Vulnerable Spring components in Ambari - CVE-2020-5398, CVE-2020-5421 (dlysnichenko) (#3246) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://www.oracle.com/security-alerts/cpuoct2020.html (opens in a new tab)x_refsource_MISCx_transferred
- [ambari-issues] 20201021 [jira] [Resolved] (AMBARI-25571) Vulnerable Spring components in Ambari - CVE-2020-5398, CVE-2020-5421 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://www.oracle.com/security-alerts/cpujan2021.html (opens in a new tab)x_refsource_MISCx_transferred
- [rocketmq-dev] 20210317 [GitHub] [rocketmq-externals] vongosling commented on issue #690: Spring Framework CVE-2020-5398 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://www.oracle.com/security-alerts/cpuApr2021.html (opens in a new tab)x_refsource_MISCx_transferred
- https://lists.apache.org/thread.html/rded5291e25a4c4085a6d43cf262e479140198bf4eabb84986e0a1ef3%40%3Cdev.rocketmq.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
- https://lists.apache.org/thread.html/r645408661a8df9158f49e337072df39838fa76da629a7e25a20928a6%40%3Cdev.rocketmq.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
- https://lists.apache.org/thread.html/r27552d2fa10d96f2810c50d16ad1fd1899e37796c81a0c5e7585a02d%40%3Cdev.rocketmq.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
- https://www.oracle.com//security-alerts/cpujul2021.html (opens in a new tab)x_refsource_MISCx_transferred
- https://www.oracle.com/security-alerts/cpuoct2021.html (opens in a new tab)x_refsource_MISCx_transferred
- https://security.netapp.com/advisory/ntap-20210917-0006/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://www.oracle.com/security-alerts/cpujul2022.html (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2020-0259 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-8wx2-9q48-vm9r (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2020-5398)Record last updated .