{
  "@id": "urn:uuid:18813819-14bf-4ed9-84cc-513220822653",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T00:08:39.035649+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.32-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.32-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T00:08:39.035649+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework 5.3.32 is not affected by CVE-2020-5421. The vulnerability (RFD bypass via jsessionid path parameter) was fixed in upstream commits eb11c6fa23 and 204a7fe91f, both authored by Rossen Stoyanchev (VMware). These fixes were already present in the upstream Spring Framework 5.3.32 release that TuxCare onboarded (commit 0632462efc). The target code contains both defense mechanisms: (...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.32 is not affected by CVE-2020-5421. The vulnerability (RFD bypass via jsessionid path parameter) was fixed in upstream commits eb11c6fa23 and 204a7fe91f, both authored by Rossen Stoyanchev (VMware). These fixes were already present in the upstream Spring Framework 5.3.32 release that TuxCare onboarded (commit 0632462efc). The target code contains both defense mechanisms: (..."
    }
  ]
}