{
  "@id": "urn:uuid:906915bd-6bf5-4152-a5f5-63ec7fac6336",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 34,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:56:00.134120+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.2.17.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.2.17.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T23:56:00.134120+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-framework-bom. not_affected \u2014 The target Spring Framework 5.2.17.RELEASE is NOT affected by CVE-2020-5421. The vulnerability (bypass of RFD protections via jsessionid path parameters) was fixed in upstream commit eb11c6fa23 (Oct 7, 2020) and was already present in the 5.2.17.RELEASE when TuxCare onboarded it. Both defense mechanisms are working: UrlPathHelper.removeJsessionid() always strips jsessionid from request URIs (ev...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.2.17.RELEASE is NOT affected by CVE-2020-5421. The vulnerability (bypass of RFD protections via jsessionid path parameters) was fixed in upstream commit eb11c6fa23 (Oct 7, 2020) and was already present in the 5.2.17.RELEASE when TuxCare onboarded it. Both defense mechanisms are working: UrlPathHelper.removeJsessionid() always strips jsessionid from request URIs (ev..."
    }
  ]
}