{
  "@id": "urn:uuid:a295a771-d6de-4f02-aa3d-38e421313a80",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:39:20.953914+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T23:39:20.953914+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.3.13-tuxcare.1 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 (RFD attack bypass via jsessionid path parameter) is not present in Spring Framework 5.3.13. The upstream fix was already included in the 5.3.13 release. The target code contains both defense mechanisms: UrlPathHelper.removeJsessionid() strips jsessionid parameters from request paths even when semicolon removal is disabled, and WebUtils.parseMatrixVariables() filters jsessionid fr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 (RFD attack bypass via jsessionid path parameter) is not present in Spring Framework 5.3.13. The upstream fix was already included in the 5.3.13 release. The target code contains both defense mechanisms: UrlPathHelper.removeJsessionid() strips jsessionid parameters from request paths even when semicolon removal is disabled, and WebUtils.parseMatrixVariables() filters jsessionid fr..."
    }
  ]
}