{
  "@id": "urn:uuid:7035247e-be74-44ee-be60-45c3c3b49796",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:36:54.449599+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.27-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T23:36:54.449599+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.3.27-tuxcare.8 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 is not present in Spring Framework 5.3.27. The vulnerability (RFD attack bypass via jsessionid path parameters) was fixed by upstream Spring Framework in commit eb11c6fa233092506d360fb46d40d489107efd5f (Oct 7, 2020) and shipped in v5.2.10 and v5.3.0, both predating v5.3.27. The target contains the complete fix: the removeJsessionid() method in UrlPathHelper.java ensures jsessionid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 is not present in Spring Framework 5.3.27. The vulnerability (RFD attack bypass via jsessionid path parameters) was fixed by upstream Spring Framework in commit eb11c6fa233092506d360fb46d40d489107efd5f (Oct 7, 2020) and shipped in v5.2.10 and v5.3.0, both predating v5.3.27. The target contains the complete fix: the removeJsessionid() method in UrlPathHelper.java ensures jsessionid..."
    }
  ]
}