CVE-2015-5211
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and…
Technology
Spring Framework
CVSS Score
9.6 / 10.0
Affected Versions
3.2.0; 3.2.1; 3.2.2; 3.2.3
Upstream Fix
See upstream advisory
Published
May 25, 2017
OSSeva Coverage
Fixed upstream
Description
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
Is your Spring Framework deployment affected?
If you're running 3.2.0; 3.2.1; 3.2.2; 3.2.3, you need this patch. Book a discovery call to get covered.