{"id":"CVE-2020-5397","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-5397","generatedAt":"2026-10-27T23:26:06.736Z","title":"Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints.","description":"Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.","published":"2020-01-17T19:15:15.000Z","lastModified":"2026-06-17T03:21:25.000Z","status":"Modified","sourceIdentifier":"security@pivotal.io","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"cwe":["CWE-352"],"affected":["vmware/spring framework","oracle/application testing suite","oracle/communications brm - elastic charging engine","oracle/communications diameter signaling router","oracle/communications element manager","oracle/communications policy management","oracle/communications session route manager","oracle/enterprise manager base platform","oracle/financial services regulatory reporting with agilereporter","oracle/flexcube private banking","oracle/healthcare master person index","oracle/insurance calculation engine","oracle/insurance policy administration j2ee","oracle/insurance rules palette","oracle/mysql enterprise monitor","oracle/rapid planning","oracle/retail assortment planning","oracle/retail back office","oracle/retail central office","oracle/retail financial integration","oracle/retail integration bus","oracle/retail order broker","oracle/retail point-of-service","oracle/retail predictive application server","oracle/retail returns management","oracle/retail service backbone","oracle/weblogic server"],"epss":{"score":0.02551,"percentile":0.84929,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (2.55%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://pivotal.io/security/cve-2020-5397","tags":["Exploit","Vendor Advisory"],"source":"security@pivotal.io"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["Patch","Third Party Advisory"],"source":"security@pivotal.io"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["Patch","Third Party Advisory"],"source":"security@pivotal.io"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["Patch","Third Party Advisory"],"source":"security@pivotal.io"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","source":"security@pivotal.io"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["Patch","Third Party Advisory"],"source":"security@pivotal.io"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["Patch","Third Party Advisory"],"source":"security@pivotal.io"},{"url":"https://pivotal.io/security/cve-2020-5397","tags":["Exploit","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-5397","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}