Improper Input Validation in Spring Framework
Moderate severity
GitHub Reviewed
Published
Apr 30, 2021
to the GitHub Advisory Database
•
Updated Aug 13, 2023
Package
Affected versions
>= 5.2.0, <= 5.2.8
>= 5.1.0, <= 5.1.17
>= 5.0.0, <= 5.0.18
< 4.3.29
Patched versions
5.2.9
5.1.18
5.0.19
4.3.29
Description
Published by the National Vulnerability Database
Sep 19, 2020
Reviewed
Apr 27, 2021
Published to the GitHub Advisory Database
Apr 30, 2021
Last updated
Aug 13, 2023
Credits
-
joshbressers Analyst
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
References