Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-5397

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.

Published

2020-01-17T19:15:14.727

Last Modified

2024-11-21T05:34:03.850

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: HIGH
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

4.9

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-352
  • Type: Primary
    CWE-352
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application vmware spring_framework < 5.2.3 Yes
Application oracle application_testing_suite 13.3.0.1 Yes
Application oracle communications_brm_-_elastic_charging_engine 11.3 Yes
Application oracle communications_brm_-_elastic_charging_engine 12.0 Yes
Application oracle communications_diameter_signaling_router ≤ 8.2.2 Yes
Application oracle communications_element_manager 8.1.1 Yes
Application oracle communications_element_manager 8.2.0 Yes
Application oracle communications_element_manager 8.2.1 Yes
Application oracle communications_policy_management 12.5.0 Yes
Application oracle communications_session_route_manager 8.1.1 Yes
Application oracle communications_session_route_manager 8.2.0 Yes
Application oracle communications_session_route_manager 8.2.1 Yes
Application oracle enterprise_manager_base_platform 13.2.1.0 Yes
Application oracle financial_services_regulatory_reporting_with_agilereporter 8.0.9.2.0 Yes
Application oracle flexcube_private_banking 12.0.0 Yes
Application oracle flexcube_private_banking 12.1.0 Yes
Application oracle healthcare_master_person_index 4.0.2 Yes
Application oracle insurance_calculation_engine ≤ 11.3.1 Yes
Application oracle insurance_policy_administration_j2ee 10.2.0 Yes
Application oracle insurance_policy_administration_j2ee 10.2.4 Yes
Application oracle insurance_policy_administration_j2ee 11.0.2 Yes
Application oracle insurance_policy_administration_j2ee 11.1.0 Yes
Application oracle insurance_policy_administration_j2ee 11.2.0 Yes
Application oracle insurance_rules_palette 10.2.0 Yes
Application oracle insurance_rules_palette 10.2.4 Yes
Application oracle insurance_rules_palette 11.0.2 Yes
Application oracle insurance_rules_palette 11.1.0 Yes
Application oracle insurance_rules_palette 11.2.0 Yes
Application oracle mysql_enterprise_monitor ≤ 4.0.12 Yes
Application oracle mysql_enterprise_monitor ≤ 8.0.20 Yes
Application oracle rapid_planning 12.1 Yes
Application oracle rapid_planning 12.2 Yes
Application oracle retail_assortment_planning 15.0 Yes
Application oracle retail_assortment_planning 16.0 Yes
Application oracle retail_back_office 14.1 Yes
Application oracle retail_central_office 14.1 Yes
Application oracle retail_financial_integration 15.0 Yes
Application oracle retail_financial_integration 16.0 Yes
Application oracle retail_integration_bus 15.0.3 Yes
Application oracle retail_integration_bus 16.0.3 Yes
Application oracle retail_order_broker 15.0 Yes
Application oracle retail_order_broker 16.0 Yes
Application oracle retail_point-of-service 14.1 Yes
Application oracle retail_predictive_application_server 14.0.3 Yes
Application oracle retail_predictive_application_server 14.1.3 Yes
Application oracle retail_predictive_application_server 15.0.3.0 Yes
Application oracle retail_predictive_application_server 16.0.3.0 Yes
Application oracle retail_returns_management 14.1 Yes
Application oracle retail_service_backbone 15.0 Yes
Application oracle retail_service_backbone 16.0 Yes
Application oracle weblogic_server 12.2.1.3.0 Yes
Application oracle weblogic_server 12.2.1.4.0 Yes
References