csirt@kutim:~/threat-intel/cve/CVE-2020-5421

Katalog CVE

CVSS 6.5 · Medium EPSS 11,4%

Kerentanan pada vmware spring framework, oracle commerce guided search +29 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

Rincian

Terbit di NVD
19 September 2020
Terakhir diubah
8 Oktober 2026
Status NVD
Modified
CVSS 3.1
6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N · uraikan di kalkulator
EPSS (30 hari)
11,4% peluang dieksploitasi; lebih tinggi dari 95,9% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
vmware spring framework Semua versi sebelum 4.3.29
vmware spring framework Versi 5.0.0 hingga sebelum 5.0.19
vmware spring framework Versi 5.1.0 hingga sebelum 5.1.18
vmware spring framework Versi 5.2.0 hingga sebelum 5.2.9
oracle commerce guided search Versi 11.3.2
oracle communications brm Versi 11.3.0.9
oracle communications brm Versi 12.0.0.3
oracle communications design studio Versi 7.3.4
oracle communications design studio Versi 7.3.5
oracle communications design studio Versi 7.4.0
oracle communications session report manager Versi 8.2.1 hingga 8.2.2.1
oracle communications unified inventory management Versi 7.3.4
oracle communications unified inventory management Versi 7.3.5
oracle endeca information discovery integrator Versi 3.2.0
oracle enterprise data quality Versi 12.2.1.3.0
oracle enterprise data quality Versi 12.2.1.4.0
oracle financial services analytical applications infrastructure Versi 8.0.6 hingga 8.1.0
oracle flexcube private banking Versi 12.0.0
oracle flexcube private banking Versi 12.1.0
oracle fusion middleware Versi 12.2.1.3.0
oracle fusion middleware Versi 12.2.1.4.0
oracle goldengate application adapters Versi 19.1.0.0.0
oracle healthcare master person index Versi 4.0.2.5
oracle hyperion infrastructure technology Versi 11.1.2.4
oracle insurance policy administration Versi 11.1.0 hingga 11.3.0
oracle insurance policy administration Versi 10.2
oracle insurance policy administration Versi 10.2.4
oracle insurance policy administration Versi 11.0.2
oracle insurance rules palette Versi 11.1.0 hingga 11.3.0
oracle insurance rules palette Versi 10.2.0
oracle insurance rules palette Versi 10.2.4
oracle insurance rules palette Versi 11.0.2
oracle mysql enterprise monitor Semua versi hingga 8.0.22
oracle mysql enterprise monitor Versi 8.0.23
oracle primavera gateway Versi 16.2.0 hingga 16.2.11
oracle primavera gateway Versi 17.12.0 hingga 17.12.9
oracle primavera gateway Versi 18.8.0 hingga 18.8.10
oracle primavera gateway Versi 19.12.0 hingga 19.12.10
oracle primavera p6 enterprise project portfolio management Versi 16.1.0 hingga 16.2.20
oracle primavera p6 enterprise project portfolio management Versi 17.1.0 hingga 17.12.19
oracle primavera p6 enterprise project portfolio management Versi 18.1.0 hingga 18.8.21
oracle primavera p6 enterprise project portfolio management Versi 19.12.0 hingga 19.12.10
oracle retail assortment planning Versi 16.0.3.0
oracle retail bulk data integration Versi 16.0.3.0
oracle retail customer engagement Versi 16.0 hingga 19.0
oracle retail customer management and segmentation foundation Versi 16.0 hingga 19.0
oracle retail financial integration Versi 14.1.3
oracle retail financial integration Versi 15.0.3
oracle retail financial integration Versi 16.0.3
oracle retail integration bus Versi 14.1.3
oracle retail integration bus Versi 15.0.3
oracle retail integration bus Versi 16.0.3
oracle retail invoice matching Versi 14.0
oracle retail invoice matching Versi 14.1
oracle retail merchandising system Versi 16.0.3
oracle retail order broker Versi 15.0
oracle retail order broker Versi 16.0
oracle retail predictive application server Versi 14.1
oracle retail returns management Versi 14.1
oracle retail service backbone Versi 14.1.3

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 77 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 12:28 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.