{
  "@id": "urn:uuid:d475d24e-f90e-4edb-bc93-f40b9c8b95ea",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:58:00.120730+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.0.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.0.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T23:58:00.120730+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.0.11-tuxcare.2 of org.springframework:spring-framework-bom. not_affected \u2014 Target version 6.0.11 is NOT AFFECTED by CVE-2020-5421. The vulnerability allows bypassing RFD (Reflected File Download) attack protections through jsessionid path parameters. The upstream fix was already present in Spring Framework 6.0.11 when TuxCare onboarded it. Both required defense mechanisms are in place: (1) UrlPathHelper.removeJsessionid() removes jsessionid from request URIs even when...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 Target version 6.0.11 is NOT AFFECTED by CVE-2020-5421. The vulnerability allows bypassing RFD (Reflected File Download) attack protections through jsessionid path parameters. The upstream fix was already present in Spring Framework 6.0.11 when TuxCare onboarded it. Both required defense mechanisms are in place: (1) UrlPathHelper.removeJsessionid() removes jsessionid from request URIs even when..."
    }
  ]
}