{
  "@id": "urn:uuid:81a7dcea-66bf-45d6-9cd7-2db51fdefd45",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T00:04:06.223229+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.2.25.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.2.25.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T00:04:06.223229+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.2.25.RELEASE-tuxcare.3 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 affects Spring Framework 5.2.0-5.2.8 where jsessionid path parameters could bypass RFD (Reflected File Download) attack protections from CVE-2015-5211. The target version 5.2.25.RELEASE is NOT affected because the vulnerability pattern is not present. The fix was authored by upstream Spring developer Rossen Stoyanchev and shipped in Spring Framework 5.2.10.RELEASE (October 2020), ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 affects Spring Framework 5.2.0-5.2.8 where jsessionid path parameters could bypass RFD (Reflected File Download) attack protections from CVE-2015-5211. The target version 5.2.25.RELEASE is NOT affected because the vulnerability pattern is not present. The fix was authored by upstream Spring developer Rossen Stoyanchev and shipped in Spring Framework 5.2.10.RELEASE (October 2020), ..."
    }
  ]
}