{
  "@id": "urn:uuid:fd9be4b0-237b-4b00-ad23-dd5548d276d2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 31,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:40:39.507681+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T23:40:39.507681+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.3.15-tuxcare.2 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 (RFD attack bypass via jsessionid path parameter) is NOT present in Spring Framework 5.3.15. The upstream fix was already included in the 5.3.15 release (Jan 2022), before TuxCare onboarded this version. The fix ensures jsessionid path parameters are always stripped from request URIs, preventing attackers from injecting malicious file extensions through this vector.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 (RFD attack bypass via jsessionid path parameter) is NOT present in Spring Framework 5.3.15. The upstream fix was already included in the 5.3.15 release (Jan 2022), before TuxCare onboarded this version. The fix ensures jsessionid path parameters are always stripped from request URIs, preventing attackers from injecting malicious file extensions through this vector."
    }
  ]
}