{
  "@id": "urn:uuid:ff12eaff-27a5-4683-b88b-58daf910f6ea",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:56:54.849795+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.23-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.23-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T23:56:54.849795+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.3.23-tuxcare.2 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 is NOT present in Spring Framework 5.3.23. The vulnerability involved RFD (Reflected File Download) attack bypass via jsessionid path parameters. The upstream vendor (Spring/VMware) fixed this issue in commits eb11c6fa and 899761f, which were included in Spring Framework 5.3.0 (released October 2020). The target version 5.3.23 inherited this fix from the upstream release. Both def...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 is NOT present in Spring Framework 5.3.23. The vulnerability involved RFD (Reflected File Download) attack bypass via jsessionid path parameters. The upstream vendor (Spring/VMware) fixed this issue in commits eb11c6fa and 899761f, which were included in Spring Framework 5.3.0 (released October 2020). The target version 5.3.23 inherited this fix from the upstream release. Both def..."
    }
  ]
}