{
  "@id": "urn:uuid:c92f6c35-1d5a-414a-b90b-07450177fd29",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 30,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:55:00.165376+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T23:55:00.165376+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.3.9-tuxcare.3 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 is NOT present in Spring Framework 5.3.9. The vulnerability allowed bypassing RFD (Reflected File Download) protections via jsessionid path parameters. The complete fix (including the bug fix) was already included in the upstream Spring Framework 5.3.9 release when TuxCare onboarded this version. The fix ensures jsessionid path parameters are always stripped from request URIs befo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 is NOT present in Spring Framework 5.3.9. The vulnerability allowed bypassing RFD (Reflected File Download) protections via jsessionid path parameters. The complete fix (including the bug fix) was already included in the upstream Spring Framework 5.3.9 release when TuxCare onboarded this version. The fix ensures jsessionid path parameters are always stripped from request URIs befo..."
    }
  ]
}