CVE-2020-5397
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints.
Does this matter?
Lower severity and a low EPSS score (2.38%). Track it; it rarely justifies an emergency change on its own.
Description
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 2.38% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- vmware/spring framework · oracle/application testing suite · oracle/communications brm - elastic charging engine · oracle/communications diameter signaling router · oracle/communications element manager · oracle/communications policy management · oracle/communications session route manager · oracle/enterprise manager base platform · oracle/financial services regulatory reporting with agilereporter · oracle/flexcube private banking · oracle/healthcare master person index · oracle/insurance calculation engine · oracle/insurance policy administration j2ee · oracle/insurance rules palette · oracle/mysql enterprise monitor · oracle/rapid planning · oracle/retail assortment planning · oracle/retail back office · oracle/retail central office · oracle/retail financial integration · +7 more
- Source
- security@pivotal.io
References
- https://pivotal.io/security/cve-2020-5397Exploit, Vendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://pivotal.io/security/cve-2020-5397Exploit, Vendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.