{
  "@id": "urn:uuid:2ad5570e-989c-493e-a339-a36683f1f732",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:57:20.039923+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T23:57:20.039923+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.3.18-tuxcare.2 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 is NOT present in Spring Framework 5.3.18. The vulnerability, which allowed bypassing RFD (Reflected File Download) protections via jsessionid path parameters, was fixed by upstream Spring Framework commits that shipped in this release. The target contains the complete fix: UrlPathHelper.removeJsessionid() properly strips jsessionid path parameters even when semicolon content remo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 is NOT present in Spring Framework 5.3.18. The vulnerability, which allowed bypassing RFD (Reflected File Download) protections via jsessionid path parameters, was fixed by upstream Spring Framework commits that shipped in this release. The target contains the complete fix: UrlPathHelper.removeJsessionid() properly strips jsessionid path parameters even when semicolon content remo..."
    }
  ]
}