{"schemaVersion":3,"id":"CVE-2020-5421","aliases":["UBUNTU-CVE-2020-5421","DEBIAN-CVE-2020-5421","GHSA-rv39-3qh7-9v7w"],"status":"published","duplicateOf":null,"title":null,"description":"In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.","dates":{"published":"2020-09-19T03:45:13.127Z","modified":"2026-10-08T21:03:32.847Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.7,"severity":"high","version":"3.0","versionLabel":"v3.0","source":"CVE.org","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":8.7,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N","exploitability":3.3,"impact":7.8,"computed":true},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Ubuntu","score":8.7,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","exploitability":5.9,"impact":9.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N","exploitability":3.3,"impact":7.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N","exploitability":3.3,"impact":7.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":8.7,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":3.6,"severity":"low","vector":"AV:N/AC:H/Au:S/C:P/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.11564,"percentile":0.95995,"severity":"medium","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0.828000000000001,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.10736},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.10392,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.11397,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.11564,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.11564,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.11564,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.11564,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.11564,"percentile":0.95995}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.10736,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.10392,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.11397,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.11564,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.11564,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.11564,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.11564,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.11564,"percentile":0.95995}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"debian","product":"libspring-java","name":"libspring-java","label":"libspring-java","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libspring-java","purlType":"deb","versions":[{"text":"< 4.3.30-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.30-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"libspring-java","name":"libspring-java","label":"libspring-java","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libspring-java","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"org.springframework","product":"spring-framework-bom","name":"org.springframework:spring-framework-bom","label":"spring-framework-bom","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.springframework/spring-framework-bom","purlType":"maven","versions":[{"text":"≥ 5.2.0, < 5.2.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.1.0, < 5.1.18","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0, < 5.0.19","noFixRecorded":false,"fixedIn":null},{"text":"< 4.3.29","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.2.0, < 5.2.9 | ≥ 5.1.0, < 5.1.18 | ≥ 5.0.0, < 5.0.19 | < 4.3.29","eol":null,"hubHref":null},{"vendor":"netapp","product":"oncommand_insight","name":"oncommand insight","label":"oncommand_insight","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/netapp/oncommand_insight"},{"vendor":"netapp","product":"snap_creator_framework","name":"snap creator framework","label":"snap_creator_framework","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/netapp/snap_creator_framework"},{"vendor":"netapp","product":"snapcenter","name":"snapcenter","label":"snapcenter","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/netapp/snapcenter"},{"vendor":"oracle","product":"commerce_guided_search","name":"commerce guided search","label":"commerce_guided_search","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"11.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.3.2","eol":null,"hubHref":"/vendor/oracle/commerce_guided_search"},{"vendor":"oracle","product":"communications_brm","name":"communications brm","label":"communications_brm","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"11.3.0.9","noFixRecorded":false,"fixedIn":null},{"text":"12.0.0.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.3.0.9 | 12.0.0.3","eol":null,"hubHref":"/vendor/oracle/communications_brm"},{"vendor":"oracle","product":"communications_design_studio","name":"communications design studio","label":"communications_design_studio","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.3.4","noFixRecorded":false,"fixedIn":null},{"text":"7.3.5","noFixRecorded":false,"fixedIn":null},{"text":"7.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.3.4 | 7.3.5 | 7.4.0","eol":null,"hubHref":"/vendor/oracle/communications_design_studio"},{"vendor":"oracle","product":"communications_session_report_manager","name":"communications session report manager","label":"communications_session_report_manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.2.1, ≤ 8.2.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.2.1, ≤ 8.2.2.1","eol":null,"hubHref":"/vendor/oracle/communications_session_report_manager"},{"vendor":"oracle","product":"communications_unified_inventory_management","name":"communications unified inventory management","label":"communications_unified_inventory_management","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.3.4","noFixRecorded":false,"fixedIn":null},{"text":"7.3.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.3.4 | 7.3.5","eol":null,"hubHref":"/vendor/oracle/communications_unified_inventory_management"},{"vendor":"oracle","product":"endeca_information_discovery_integrator","name":"endeca information discovery integrator","label":"endeca_information_discovery_integrator","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"3.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"3.2.0","eol":null,"hubHref":"/vendor/oracle/endeca_information_discovery_integrator"},{"vendor":"oracle","product":"enterprise_data_quality","name":"enterprise data quality","label":"enterprise_data_quality","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"12.2.1.3.0","noFixRecorded":false,"fixedIn":null},{"text":"12.2.1.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"12.2.1.3.0 | 12.2.1.4.0","eol":null,"hubHref":"/vendor/oracle/enterprise_data_quality"},{"vendor":"oracle","product":"financial_services_analytical_applications_infrastructure","name":"financial services analytical applications infrastructure","label":"financial_services_analytical_applications_infrastructure","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.0.6, ≤ 8.1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.0.6, ≤ 8.1.0","eol":null,"hubHref":"/vendor/oracle/financial_services_analytical_applications_infrastructure"},{"vendor":"oracle","product":"flexcube_private_banking","name":"flexcube private banking","label":"flexcube_private_banking","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"12.0.0","noFixRecorded":false,"fixedIn":null},{"text":"12.1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"12.0.0 | 12.1.0","eol":null,"hubHref":"/vendor/oracle/flexcube_private_banking"},{"vendor":"oracle","product":"fusion_middleware","name":"Fusion Middleware","label":"fusion_middleware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"12.2.1.3.0","noFixRecorded":false,"fixedIn":null},{"text":"12.2.1.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"12.2.1.3.0 | 12.2.1.4.0","eol":null,"hubHref":"/vendor/oracle/fusion_middleware"},{"vendor":"oracle","product":"goldengate_application_adapters","name":"goldengate application adapters","label":"goldengate_application_adapters","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"19.1.0.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"19.1.0.0.0","eol":null,"hubHref":"/vendor/oracle/goldengate_application_adapters"},{"vendor":"oracle","product":"healthcare_master_person_index","name":"healthcare master person index","label":"healthcare_master_person_index","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.0.2.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.0.2.5","eol":null,"hubHref":"/vendor/oracle/healthcare_master_person_index"},{"vendor":"oracle","product":"hyperion_infrastructure_technology","name":"hyperion infrastructure technology","label":"hyperion_infrastructure_technology","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"11.1.2.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.1.2.4","eol":null,"hubHref":"/vendor/oracle/hyperion_infrastructure_technology"},{"vendor":"oracle","product":"insurance_policy_administration","name":"insurance policy administration","label":"insurance_policy_administration","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 11.1.0, ≤ 11.3.0","noFixRecorded":false,"fixedIn":null},{"text":"10.2","noFixRecorded":false,"fixedIn":null},{"text":"10.2.4","noFixRecorded":false,"fixedIn":null},{"text":"11.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 11.1.0, ≤ 11.3.0 | 10.2 | 10.2.4 | 11.0.2","eol":null,"hubHref":"/vendor/oracle/insurance_policy_administration"},{"vendor":"oracle","product":"insurance_rules_palette","name":"insurance rules palette","label":"insurance_rules_palette","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 11.1.0, ≤ 11.3.0","noFixRecorded":false,"fixedIn":null},{"text":"10.2.0","noFixRecorded":false,"fixedIn":null},{"text":"10.2.4","noFixRecorded":false,"fixedIn":null},{"text":"11.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 11.1.0, ≤ 11.3.0 | 10.2.0 | 10.2.4 | 11.0.2","eol":null,"hubHref":"/vendor/oracle/insurance_rules_palette"},{"vendor":"oracle","product":"mysql_enterprise_monitor","name":"mysql enterprise monitor","label":"mysql_enterprise_monitor","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 8.0.22","noFixRecorded":false,"fixedIn":null},{"text":"8.0.23","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 8.0.22 | 8.0.23","eol":null,"hubHref":"/vendor/oracle/mysql_enterprise_monitor"},{"vendor":"oracle","product":"primavera_gateway","name":"primavera gateway","label":"primavera_gateway","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.2.0, ≤ 16.2.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 17.12.0, ≤ 17.12.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 18.8.0, ≤ 18.8.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 19.12.0, ≤ 19.12.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.2.0, ≤ 16.2.11 | ≥ 17.12.0, ≤ 17.12.9 | ≥ 18.8.0, ≤ 18.8.10 | ≥ 19.12.0, ≤ 19.12.10","eol":null,"hubHref":"/vendor/oracle/primavera_gateway"},{"vendor":"oracle","product":"primavera_p6_enterprise_project_portfolio_management","name":"primavera p6 enterprise project portfolio management","label":"primavera_p6_enterprise_project_portfolio_management","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.1.0, ≤ 16.2.20","noFixRecorded":false,"fixedIn":null},{"text":"≥ 17.1.0, ≤ 17.12.19","noFixRecorded":false,"fixedIn":null},{"text":"≥ 18.1.0, ≤ 18.8.21","noFixRecorded":false,"fixedIn":null},{"text":"≥ 19.12.0, ≤ 19.12.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.1.0, ≤ 16.2.20 | ≥ 17.1.0, ≤ 17.12.19 | ≥ 18.1.0, ≤ 18.8.21 | ≥ 19.12.0, ≤ 19.12.10","eol":null,"hubHref":"/vendor/oracle/primavera_p6_enterprise_project_portfolio_management"},{"vendor":"oracle","product":"retail_assortment_planning","name":"retail assortment planning","label":"retail_assortment_planning","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"16.0.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"16.0.3.0","eol":null,"hubHref":"/vendor/oracle/retail_assortment_planning"},{"vendor":"oracle","product":"retail_bulk_data_integration","name":"retail bulk data integration","label":"retail_bulk_data_integration","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"16.0.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"16.0.3.0","eol":null,"hubHref":"/vendor/oracle/retail_bulk_data_integration"},{"vendor":"oracle","product":"retail_customer_engagement","name":"retail customer engagement","label":"retail_customer_engagement","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0, ≤ 19.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0, ≤ 19.0","eol":null,"hubHref":"/vendor/oracle/retail_customer_engagement"},{"vendor":"oracle","product":"retail_customer_management_and_segmentation_foundation","name":"retail customer management and segmentation foundation","label":"retail_customer_management_and_segmentation_foundation","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0, ≤ 19.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0, ≤ 19.0","eol":null,"hubHref":"/vendor/oracle/retail_customer_management_and_segmentation_foundation"},{"vendor":"oracle","product":"retail_financial_integration","name":"retail financial integration","label":"retail_financial_integration","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"14.1.3","noFixRecorded":false,"fixedIn":null},{"text":"15.0.3","noFixRecorded":false,"fixedIn":null},{"text":"16.0.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"14.1.3 | 15.0.3 | 16.0.3","eol":null,"hubHref":"/vendor/oracle/retail_financial_integration"},{"vendor":"oracle","product":"retail_integration_bus","name":"retail integration bus","label":"retail_integration_bus","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"14.1.3","noFixRecorded":false,"fixedIn":null},{"text":"15.0.3","noFixRecorded":false,"fixedIn":null},{"text":"16.0.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"14.1.3 | 15.0.3 | 16.0.3","eol":null,"hubHref":"/vendor/oracle/retail_integration_bus"},{"vendor":"oracle","product":"retail_invoice_matching","name":"retail invoice matching","label":"retail_invoice_matching","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"14.0","noFixRecorded":false,"fixedIn":null},{"text":"14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"14.0 | 14.1","eol":null,"hubHref":"/vendor/oracle/retail_invoice_matching"},{"vendor":"oracle","product":"retail_merchandising_system","name":"retail merchandising system","label":"retail_merchandising_system","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"16.0.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"16.0.3","eol":null,"hubHref":"/vendor/oracle/retail_merchandising_system"},{"vendor":"oracle","product":"retail_order_broker","name":"retail order broker","label":"retail_order_broker","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"15.0","noFixRecorded":false,"fixedIn":null},{"text":"16.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"15.0 | 16.0","eol":null,"hubHref":"/vendor/oracle/retail_order_broker"},{"vendor":"oracle","product":"retail_predictive_application_server","name":"retail predictive application server","label":"retail_predictive_application_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"14.1","eol":null,"hubHref":"/vendor/oracle/retail_predictive_application_server"},{"vendor":"oracle","product":"retail_returns_management","name":"retail returns management","label":"retail_returns_management","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"14.1","eol":null,"hubHref":"/vendor/oracle/retail_returns_management"},{"vendor":"oracle","product":"retail_service_backbone","name":"retail service backbone","label":"retail_service_backbone","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"14.1.3","noFixRecorded":false,"fixedIn":null},{"text":"15.0.3","noFixRecorded":false,"fixedIn":null},{"text":"16.0.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"14.1.3 | 15.0.3 | 16.0.3","eol":null,"hubHref":"/vendor/oracle/retail_service_backbone"},{"vendor":"oracle","product":"retail_xstore_point_of_service","name":"retail xstore point of service","label":"retail_xstore_point_of_service","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"15.0.4","noFixRecorded":false,"fixedIn":null},{"text":"16.0.6","noFixRecorded":false,"fixedIn":null},{"text":"17.0.4","noFixRecorded":false,"fixedIn":null},{"text":"18.0.3","noFixRecorded":false,"fixedIn":null},{"text":"19.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"15.0.4 | 16.0.6 | 17.0.4 | 18.0.3 | 19.0.2","eol":null,"hubHref":"/vendor/oracle/retail_xstore_point_of_service"},{"vendor":"oracle","product":"storagetek_acsls","name":"storagetek acsls","label":"storagetek_acsls","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"8.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.5.1","eol":null,"hubHref":"/vendor/oracle/storagetek_acsls"},{"vendor":"oracle","product":"storagetek_tape_analytics_sw_tool","name":"storagetek tape analytics sw tool","label":"storagetek_tape_analytics_sw_tool","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"2.3","eol":null,"hubHref":"/vendor/oracle/storagetek_tape_analytics_sw_tool"},{"vendor":"oracle","product":"weblogic_server","name":"WebLogic Server","label":"weblogic_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"10.3.6.0.0","noFixRecorded":false,"fixedIn":null},{"text":"12.1.3.0.0","noFixRecorded":false,"fixedIn":null},{"text":"12.2.1.3.0","noFixRecorded":false,"fixedIn":null},{"text":"12.2.1.4.0","noFixRecorded":false,"fixedIn":null},{"text":"14.1.1.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.3.6.0.0 | 12.1.3.0.0 | 12.2.1.3.0 | 12.2.1.4.0 | 14.1.1.0.0","eol":null,"hubHref":"/vendor/oracle/weblogic_server"},{"vendor":"spring by vmware","product":"spring framework","name":"Spring Framework","label":"spring framework","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.3, < 4.3.29","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0, < 5.0.19","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.1, < 5.1.18","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.2, < 5.2.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.3, < 4.3.29 | ≥ 5.0, < 5.0.19 | ≥ 5.1, < 5.1.18 | ≥ 5.2, < 5.2.9","eol":null,"hubHref":"/vendor/spring_by_vmware/spring_framework"},{"vendor":"vmware","product":"spring_framework","name":"Spring Framework","label":"spring_framework","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.3.29","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0, < 5.0.19","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.1.0, < 5.1.18","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.2.0, < 5.2.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.29 | ≥ 5.0.0, < 5.0.19 | ≥ 5.1.0, < 5.1.18 | ≥ 5.2.0, < 5.2.9","eol":null,"hubHref":"/vendor/vmware/spring_framework"}],"affectedCount":42,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://tanzu.vmware.com/security/cve-2020-5421","label":"tanzu.vmware.com/security/cve-2020-5421","hostname":"tanzu.vmware.com","tags":["X Refsource CONFIRM","REPORT","WEB","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/re014a49d77f038ba70e5e9934d400af6653e8c9ac110d32b1254127e%40%3Cdev.ranger.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a%40%3Cissues.ambari.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1%40%3Cdev.ambari.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a%40%3Cdev.ambari.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163%40%3Ccommits.ambari.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5%40%3Cissues.ambari.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/rf00d8f4101a1c1ea4de6ea1e09ddf7472cfd306745c90d6da87ae074%40%3Cdev.hive.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/rc9efaf6db98bee19db1bc911d0fa442287dac5cb229d4aaa08b6a13d%40%3Cissues.hive.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/r7e6a213eea7f04fc6d9e3bd6eb8d68c4df92a22e956e95cb2c482865%40%3Cissues.hive.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/r503e64b43a57fd68229cac4a869d1a9a2eac9e75f8719cad3a840211%40%3Ccommits.pulsar.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/r918caad55dcc640a16753b00d8d6acb90b4e36de4b6156d0867246ec%40%3Ccommits.pulsar.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/r3589ed0d18edeb79028615080d5a0e8878856436bb91774a3196d9eb%40%3Ccommits.pulsar.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/rb18ed999153ef0f0cb7af03efe0046c42c7242fd77fbd884a75ecfdc%40%3Ccommits.pulsar.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/raf7ca57033e537e4f9d7df7f192fa6968c1e49409b2348e08d807ccb%40%3Cuser.ignite.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/ra889d95141059c6cbe77dd80249bb488ae53b274b5f3abad09d9511d%40%3Cuser.ignite.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://lists.apache.org/thread.html/rd462a8b0dfab4c15e67c0672cd3c211ecd0e4f018f824082ed54f665%40%3Cissues.hive.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","label":"www.oracle.com/security-alerts/cpujan2021.html","hostname":"www.oracle.com","tags":["X Refsource MISC","WEB","Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"www.oracle.com/security-alerts/cpuApr2021.html","hostname":"www.oracle.com","tags":["X Refsource MISC","WEB","Patch","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210513-0009/","label":"security.netapp.com/advisory/ntap-20210513-0009/","hostname":"security.netapp.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"www.oracle.com//security-alerts/cpujul2021.html","hostname":"www.oracle.com","tags":["X Refsource MISC","WEB","Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"www.oracle.com/security-alerts/cpuoct2021.html","hostname":"www.oracle.com","tags":["X Refsource MISC","WEB","Not Applicable","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"www.oracle.com/security-alerts/cpujan2022.html","hostname":"www.oracle.com","tags":["X Refsource MISC","WEB","Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"www.oracle.com/security-alerts/cpuapr2022.html","hostname":"www.oracle.com","tags":["X Refsource MISC","WEB","Patch","Third Party Advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-5421","label":"ubuntu.com/security/CVE-2020-5421","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-5421","label":"www.cve.org/CVERecord?id=CVE-2020-5421","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-5421","label":"security-tracker.debian.org/tracker/CVE-2020-5421","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5421","label":"nvd.nist.gov/vuln/detail/CVE-2020-5421","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210513-0009","label":"security.netapp.com/advisory/ntap-20210513-0009","hostname":"security.netapp.com","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/rf00d8f4101a1c1ea4de6ea1e09ddf7472cfd306745c90d6da87ae074@%3Cdev.hive.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/re014a49d77f038ba70e5e9934d400af6653e8c9ac110d32b1254127e@%3Cdev.ranger.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/rd462a8b0dfab4c15e67c0672cd3c211ecd0e4f018f824082ed54f665@%3Cissues.hive.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/rc9efaf6db98bee19db1bc911d0fa442287dac5cb229d4aaa08b6a13d@%3Cissues.hive.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/rb18ed999153ef0f0cb7af03efe0046c42c7242fd77fbd884a75ecfdc@%3Ccommits.pulsar.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/raf7ca57033e537e4f9d7df7f192fa6968c1e49409b2348e08d807ccb@%3Cuser.ignite.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/ra889d95141059c6cbe77dd80249bb488ae53b274b5f3abad09d9511d@%3Cuser.ignite.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1@%3Cdev.ambari.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/r918caad55dcc640a16753b00d8d6acb90b4e36de4b6156d0867246ec@%3Ccommits.pulsar.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a@%3Cdev.ambari.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/r7e6a213eea7f04fc6d9e3bd6eb8d68c4df92a22e956e95cb2c482865@%3Cissues.hive.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5@%3Cissues.ambari.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/r503e64b43a57fd68229cac4a869d1a9a2eac9e75f8719cad3a840211@%3Ccommits.pulsar.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/r3589ed0d18edeb79028615080d5a0e8878856436bb91774a3196d9eb@%3Ccommits.pulsar.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a@%3Cissues.ambari.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]},{"url":"https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163@%3Ccommits.ambari.apache.org%3E","label":"lists.apache.org/thread.html/…","hostname":"lists.apache.org","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-09-19T03:45:13.127Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-08T21:03:32.847Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":37,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T08:30:56.857Z","stale":false,"partial":false}}