CVE-2020-5398: RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

Published Jan 16, 2020
·
Updated

A flaw was found in springframework in versions prior to 5.0.16, 5.1.13, and 5.2.3. A reflected file download (RFD) attack is possible when a "Content-Disposition" header is set in response to where the filename attribute is derived from user supplied input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Other sources

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Spring Framework could allow a remote attacker to obtain sensitive information, caused by a flaw when it sets a Content-Disposition header in the response. By using a reflected file download (RFD) attack, a remote attacker could exploit this vulnerability to obtain sensitive information.

IBM

Affected Software

73 affected componentsFixes available
redhat/springframework<5.2.3
5.2.3
redhat/springframework<5.1.13
5.1.13
redhat/springframework<5.0.16
5.0.16
maven/org.springframework:spring-webflux>=5.0.0.RELEASE<5.0.16.RELEASE
5.0.16.RELEASE
maven/org.springframework:spring-webflux>=5.1.0.RELEASE<5.1.13.RELEASE
5.1.13.RELEASE
maven/org.springframework:spring-webflux>=5.2.0.RELEASE<5.2.3.RELEASE
5.2.3.RELEASE
maven/org.springframework:spring-webmvc>=5.0.0.RELEASE<5.0.16.RELEASE
5.0.16.RELEASE
maven/org.springframework:spring-webmvc>=5.1.0.RELEASE<5.1.13.RELEASE
5.1.13.RELEASE
maven/org.springframework:spring-webmvc>=5.2.0.RELEASE<5.2.3.RELEASE
5.2.3.RELEASE
IBM Data Risk Manager<=2.0.6
VMware Spring Framework>=5.0.0<5.0.16
VMware Spring Framework>=5.1.0<5.1.13
VMware Spring Framework>=5.2.0<5.2.3
Oracle Application Testing Suite=13.3.0.1
Oracle Communications Billing And Revenue Management Elastic Charging Engine=11.3
Oracle Communications Billing And Revenue Management Elastic Charging Engine=12.0
Oracle Communications Cloud Native Core Policy=1.5.0
Oracle Communications Diameter Signaling Router>=8.0.0<=8.2.2
Oracle Communications Element Manager=8.1.1
Oracle Communications Element Manager=8.2.0
Oracle Communications Element Manager=8.2.1
Oracle Communications Policy Management=12.5.0
Oracle Communications Session Report Manager=8.1.1
Oracle Communications Session Report Manager=8.2.0
Oracle Communications Session Report Manager=8.2.1
Oracle Communications Session Route Manager=8.1.1
Oracle Communications Session Route Manager=8.2.0
Oracle Communications Session Route Manager=8.2.1
Oracle Enterprise Manager Base Platform=13.2.1.0
Oracle Financial Services Regulatory Reporting With Agilereporter=8.0.9.2.0
Oracle FLEXCUBE Private Banking=12.0.0
Oracle FLEXCUBE Private Banking=12.1.0
Oracle Healthcare Master Person Index=4.0.2
Oracle Insurance Calculation Engine>=11.0.0<=11.3.1
Oracle Insurance Policy Administration J2EE=10.2.0
Oracle Insurance Policy Administration J2EE=10.2.4
Oracle Insurance Policy Administration J2EE=11.0.2
Oracle Insurance Policy Administration J2EE=11.1.0
Oracle Insurance Policy Administration J2EE=11.2.0
Oracle Insurance Policy Administration J2EE=11.2.2.0
Oracle Insurance Rules Palette=10.2.0
Oracle Insurance Rules Palette=10.2.4
Oracle Insurance Rules Palette=11.0.2
Oracle Insurance Rules Palette=11.1.0
Oracle Insurance Rules Palette=11.2.0
Oracle MySQL>=4.0.0<=4.0.12
Oracle MySQL>=8.0.0<=8.0.20
Oracle Rapid Planning=12.1
Oracle Rapid Planning=12.2
Oracle Retail Assortment Planning=15.0
Oracle Retail Assortment Planning=16.0
Oracle Retail Back Office=14.1
Oracle Retail Bulk Data Integration=16.0.3.0
Oracle Retail Central Office=14.1
Oracle Retail Financial Integration=15.0
Oracle Retail Financial Integration=16.0
Oracle Retail Integration Bus=15.0.3
Oracle Retail Integration Bus=16.0.3
Oracle Retail Order Broker=15.0
Oracle Retail Order Broker=16.0
Oracle Retail Point-of-Service=14.1
Oracle Retail Predictive Application Server=14.0.3
Oracle Retail Predictive Application Server=14.1.3.0
Oracle Retail Predictive Application Server=15.0.3
Oracle Retail Predictive Application Server=16.0.3.0
Oracle Retail Returns Management=14.1
Oracle Retail Service Backbone=15.0
Oracle Retail Service Backbone=16.0
Oracle Siebel Engineering - Installer \& Deployment<=2.1.1
Oracle WebLogic Server=12.2.1.3.0
Oracle WebLogic Server=12.2.1.4.0
NetApp Data Availability Services
NetApp Snapcenter

Event History

Jan 16, 2020
CVE Published
12:00 AM
Data Sourced
12:00 AM
RemedyDescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·11:55 PM
Data Sourced
via MITRE·11:55 PM
DescriptionSeverityWeakness
Jan 21, 2020
Advisory Published
via GitHub·08:59 PM
Feb 6, 2020
Data Sourced
via Red Hat·05:20 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2020-5398?

The severity of CVE-2020-5398 is considered to be important.

2

How do I fix CVE-2020-5398?

To fix CVE-2020-5398, you need to upgrade to Spring Framework versions 5.0.16, 5.1.13, or 5.2.3.

3

What is the impact of CVE-2020-5398?

CVE-2020-5398 allows for a reflected file download (RFD) attack due to insufficient validation of user-supplied input in the 'Content-Disposition' header.

4

Which Spring Framework versions are affected by CVE-2020-5398?

CVE-2020-5398 affects Spring Framework versions prior to 5.0.16, 5.1.13, and 5.2.3.

5

Is there a patch available for CVE-2020-5398?

Yes, patches for CVE-2020-5398 are available in the fixed versions of Spring Framework.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203