RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application
High severity
GitHub Reviewed
Published
Jan 21, 2020
to the GitHub Advisory Database
•
Updated Mar 14, 2024
Package
Affected versions
>= 5.2.0.RELEASE, < 5.2.3.RELEASE
>= 5.1.0.RELEASE, < 5.1.13.RELEASE
>= 5.0.0.RELEASE, < 5.0.16.RELEASE
Patched versions
5.2.3.RELEASE
5.1.13.RELEASE
5.0.16.RELEASE
>= 5.2.0.RELEASE, < 5.2.3.RELEASE
>= 5.1.0.RELEASE, < 5.1.13.RELEASE
>= 5.0.0.RELEASE, < 5.0.16.RELEASE
5.2.3.RELEASE
5.1.13.RELEASE
5.0.16.RELEASE
Description
Published by the National Vulnerability Database
Jan 17, 2020
Reviewed
Jan 21, 2020
Published to the GitHub Advisory Database
Jan 21, 2020
Last updated
Mar 14, 2024
Credits
-
briandealwis Analyst
-
sunSUNQ Analyst
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
References