CVE-2020-5398: RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
A flaw was found in springframework in versions prior to 5.0.16, 5.1.13, and 5.2.3. A reflected file download (RFD) attack is possible when a "Content-Disposition" header is set in response to where the filename attribute is derived from user supplied input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Spring Framework could allow a remote attacker to obtain sensitive information, caused by a flaw when it sets a Content-Disposition header in the response. By using a reflected file download (RFD) attack, a remote attacker could exploit this vulnerability to obtain sensitive information.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5398?
The severity of CVE-2020-5398 is considered to be important.
How do I fix CVE-2020-5398?
To fix CVE-2020-5398, you need to upgrade to Spring Framework versions 5.0.16, 5.1.13, or 5.2.3.
What is the impact of CVE-2020-5398?
CVE-2020-5398 allows for a reflected file download (RFD) attack due to insufficient validation of user-supplied input in the 'Content-Disposition' header.
Which Spring Framework versions are affected by CVE-2020-5398?
CVE-2020-5398 affects Spring Framework versions prior to 5.0.16, 5.1.13, and 5.2.3.
Is there a patch available for CVE-2020-5398?
Yes, patches for CVE-2020-5398 are available in the fixed versions of Spring Framework.