Spring Framework up to 5.0.15/5.1.12/5.2.2 Header Content-Disposition Reflected cross site scripting

Summaryinfo

A vulnerability has been found in Spring Framework up to 5.0.15/5.1.12/5.2.2 and classified as problematic. The affected element is an unknown function of the component Header Handler. This manipulation of the argument Content-Disposition causes cross site scripting (Reflected). The identification of this vulnerability is CVE-2020-5398. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Spring Framework up to 5.0.15/5.1.12/5.2.2 and classified as problematic. Affected by this vulnerability is an unknown part of the component Header Handler. The manipulation of the argument Content-Disposition with an unknown input leads to a cross site scripting vulnerability (Reflected). The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect confidentiality. The summary by CVE is:

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

The weakness was shared 01/17/2020 (Website). The advisory is shared at pivotal.io. This vulnerability is known as CVE-2020-5398 since 01/03/2020. The exploitation appears to be difficult. The attack can be launched remotely. A single authentication is necessary for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading to version 5.0.16, 5.1.13 or 5.2.3 eliminates this vulnerability.

The entries VDB-153634, VDB-158127, VDB-158129 and VDB-158133 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Spring Framework

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.0.9
• 5.0.10
• 5.0.11
• 5.0.12
• 5.0.13
• 5.0.14
• 5.0.15
• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.1.7
• 5.1.8
• 5.1.9
• 5.1.10
• 5.1.11
• 5.1.12
• 5.2.0
• 5.2.1
• 5.2.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion