What is the CVSS score of CVE-2020-5398?

CVE-2020-5398 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 88.1%.

Is there a patch available for CVE-2020-5398?

Yes, a patch is available for CVE-2020-5398. Update the affected software to the latest version immediately.

Java CVE-2020-5398

HIGH

Cross-site Scripting (XSS) (CWE-79)

2020-01-17 security@pivotal.io

XSS Java Spring Framework Application Testing Suite Communications Billing And Revenue Management Elastic Charging Engine Communications Cloud Native Core Policy Communications Diameter Signaling Router Communications Element Manager Communications Policy Management Communications Session Report Manager Communications Session Route Manager Enterprise Manager Base Platform Financial Services Regulatory Reporting With Agilereporter Flexcube Private Banking Healthcare Master Person Index Insurance Calculation Engine Insurance Policy Administration J2Ee Insurance Rules Palette MySQL Rapid Planning Retail Assortment Planning Retail Back Office Retail Bulk Data Integration Retail Central Office Retail Financial Integration Retail Integration Bus Retail Order Broker Retail Point Of Service Retail Predictive Application Server Retail Returns Management Retail Service Backbone Siebel Engineering Installer Deployment Weblogic Server Data Availability Services Snapcenter

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jan 17, 2020 - 00:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

20 maven packages depend on org.springframework:spring-webflux (15 direct, 5 indirect)
734 maven packages depend on org.springframework:spring-webmvc (419 direct, 315 indirect)

Ecosystem-wide dependent count for version 5.2.0.RELEASE and other introduced versions.

DescriptionNVD

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

AnalysisAI

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input. Affected products include: Vmware Spring Framework, Oracle Application Testing Suite, Oracle Communications Billing And Revenue Management Elastic Charging Engine, Oracle Communications Cloud Native Core Policy, Oracle Communications Diameter Signaling Router. Version information: prior to 5.2.3.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.