CVE-2020-5397
Description
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
How to fix
- vmware spring_framework5.2.3 or later
- org.springframework:spring-webmvc5.2.3 or later
- org.springframework:spring-webflux5.2.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware spring_framework | 5.2.0 ≤ v < 5.2.3 | 5.2.3 |
| oracle application_testing_suite | 13.3.0.1 | — |
| oracle communications_brm_-_elastic_charging_engine | 11.3, 12.0 | — |
| oracle communications_diameter_signaling_router | 8.0.0 ≤ v ≤ 8.2.2 | — |
| oracle communications_element_manager | 8.1.1, 8.2.0, 8.2.1 | — |
| oracle communications_policy_management | 12.5.0 | — |
| oracle communications_session_route_manager | 8.1.1, 8.2.0, 8.2.1 | — |
| oracle enterprise_manager_base_platform | 13.2.1.0 | — |
| oracle financial_services_regulatory_reporting_with_agilereporter | 8.0.9.2.0 | — |
| oracle flexcube_private_banking | 12.0.0, 12.1.0 | — |
| oracle healthcare_master_person_index | 4.0.2 | — |
| oracle insurance_calculation_engine | 11.0.0 ≤ v ≤ 11.3.1 | — |
| oracle insurance_policy_administration_j2ee | 10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0 | — |
| oracle insurance_rules_palette | 10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0 | — |
| oracle mysql_enterprise_monitor | 4.0.0 ≤ v ≤ 4.0.12, 8.0.0 ≤ v ≤ 8.0.20 | — |
| oracle rapid_planning | 12.1, 12.2 | — |
| oracle retail_assortment_planning | 15.0, 16.0 | — |
| oracle retail_back_office | 14.1 | — |
| oracle retail_central_office | 14.1 | — |
| oracle retail_financial_integration | 15.0, 16.0 | — |
| oracle retail_integration_bus | 15.0.3, 16.0.3 | — |
| oracle retail_order_broker | 15.0, 16.0 | — |
| oracle retail_point-of-service | 14.1 | — |
| oracle retail_predictive_application_server | 14.0.3, 14.1.3, 15.0.3.0, 16.0.3.0 | — |
| oracle retail_returns_management | 14.1 | — |
| oracle retail_service_backbone | 15.0, 16.0 | — |
| oracle weblogic_server | 12.2.1.3.0, 12.2.1.4.0 | — |
| org.springframework:spring-webmvcMaven | 5.2.0 ≤ v < 5.2.3 | 5.2.3 |
| org.springframework:spring-webfluxMaven | 5.2.0 ≤ v < 5.2.3 | 5.2.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.