{
  "@id": "urn:uuid:6a1e66c9-d4bf-4c3e-aa22-653e7c2be03d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:31:54.220564+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.7-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.7-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-30T23:31:54.220564+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.3.7-tuxcare.10 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 addresses an RFD (Reflected File Download) attack bypass via jsessionid path parameters. The target repository (Spring Framework 5.3.7) is NOT AFFECTED because the complete fix was already present in the upstream 5.3.7 release, shipped before TuxCare's onboarding. The fix ensures jsessionid path parameters are always removed from request URIs and filtered from matrix variable pars...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 addresses an RFD (Reflected File Download) attack bypass via jsessionid path parameters. The target repository (Spring Framework 5.3.7) is NOT AFFECTED because the complete fix was already present in the upstream 5.3.7 release, shipped before TuxCare's onboarding. The fix ensures jsessionid path parameters are always removed from request URIs and filtered from matrix variable pars..."
    }
  ]
}