{
  "@id": "urn:uuid:0d120f90-49f4-4aaa-a1fc-0cf4e9f97d62",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:39:20.953914+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.25-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.25-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-30T23:39:20.953914+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.3.25-tuxcare.11 of org.springframework:spring-framework-bom. not_affected \u2014 The target repository at version 5.3.25-tuxcare.11 is NOT affected by CVE-2020-5421. The vulnerability (RFD attack bypass via jsessionid path parameters) was fixed in upstream Spring Framework 5.3.0 final release (October 2020), which predates version 5.3.25 by 25 releases. The fix was authored by the upstream vendor (rstoyanchev@vmware.com) and was already present in the Spring Framework 5.3.2...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 The target repository at version 5.3.25-tuxcare.11 is NOT affected by CVE-2020-5421. The vulnerability (RFD attack bypass via jsessionid path parameters) was fixed in upstream Spring Framework 5.3.0 final release (October 2020), which predates version 5.3.25 by 25 releases. The fix was authored by the upstream vendor (rstoyanchev@vmware.com) and was already present in the Spring Framework 5.3.2..."
    }
  ]
}