{
  "@id": "urn:uuid:be4bbfe3-f051-41c8-91f0-199ea6b75a46",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T00:10:34.406741+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.1.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.1.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T00:10:34.406741+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.1.18-tuxcare.1 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 affects Spring Framework versions 5.2.0-5.2.8, 5.1.0-5.1.17, 5.0.0-5.0.18, and 4.3.0-4.3.28 by allowing jsessionid path parameters to bypass RFD (Reflected File Download) protections. The target repository at version 6.1.18 is NOT vulnerable because the upstream vendor (Spring Framework project) fixed this issue in earlier releases, and version 6.1.18 includes the complete fix. Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 affects Spring Framework versions 5.2.0-5.2.8, 5.1.0-5.1.17, 5.0.0-5.0.18, and 4.3.0-4.3.28 by allowing jsessionid path parameters to bypass RFD (Reflected File Download) protections. The target repository at version 6.1.18 is NOT vulnerable because the upstream vendor (Spring Framework project) fixed this issue in earlier releases, and version 6.1.18 includes the complete fix. Th..."
    }
  ]
}