{
  "@id": "urn:uuid:b3af4a99-9bb2-4e98-85ab-c55b52082d03",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 34,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:39:20.953914+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.1.20-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.1.20-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T23:39:20.953914+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.1.20-tuxcare.6 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework 6.1.20 is NOT vulnerable to CVE-2020-5421. The vulnerability (RFD attack bypass via jsessionid path parameters) was fixed by the upstream Spring Framework maintainers in October 2020, appearing in version 5.2.10.RELEASE and all subsequent versions. The target version 6.1.20 (released May 2025) includes this fix as part of the upstream release. The fix ensures jsessionid path pa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.20 is NOT vulnerable to CVE-2020-5421. The vulnerability (RFD attack bypass via jsessionid path parameters) was fixed by the upstream Spring Framework maintainers in October 2020, appearing in version 5.2.10.RELEASE and all subsequent versions. The target version 6.1.20 (released May 2025) includes this fix as part of the upstream release. The fix ensures jsessionid path pa..."
    }
  ]
}