In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: pivotal
Published: 2020-01-16T00:00:00
Updated: 2022-07-25T16:23:21
Reserved: 2020-01-03T00:00:00
Link: CVE-2020-5398
JSON object: View
NVD Information
Status : Modified
Published: 2020-01-17T00:15:12.103
Modified: 2023-11-07T03:23:46.420
Link: CVE-2020-5398
JSON object: View
Redhat Information
No data.