{
  "@id": "urn:uuid:b55faddf-dfe9-4f1d-a86d-67efba0ce3c8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:27:00.141453+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T23:27:00.141453+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.3.31-tuxcare.5 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 is not present in Spring Framework 5.3.31. The vulnerability, which allowed bypassing RFD (Reflected File Download) protections via jsessionid path parameters, was fixed by upstream vendor commits that were already included in the v5.3.31 release. The fix ensures jsessionid parameters are always removed from request URIs (even when semicolon content removal is disabled) and filter...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 is not present in Spring Framework 5.3.31. The vulnerability, which allowed bypassing RFD (Reflected File Download) protections via jsessionid path parameters, was fixed by upstream vendor commits that were already included in the v5.3.31 release. The fix ensures jsessionid parameters are always removed from request URIs (even when semicolon content removal is disabled) and filter..."
    }
  ]
}