{
  "@id": "urn:uuid:7274e419-0889-471d-9d85-fe17d55f2b14",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T00:04:18.514017+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.1.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.1.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T00:04:18.514017+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.1.4-tuxcare.4 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 addresses a bypass of RFD (Reflected File Download) protections through jsessionid path parameters. The vulnerability allowed attackers to inject malicious path segments after jsessionid values due to incorrect index calculation in the removeJsessionid method. Spring Framework 6.1.4 is not affected because the upstream fix (commit 204a7fe91f) was already present in the release. Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 addresses a bypass of RFD (Reflected File Download) protections through jsessionid path parameters. The vulnerability allowed attackers to inject malicious path segments after jsessionid values due to incorrect index calculation in the removeJsessionid method. Spring Framework 6.1.4 is not affected because the upstream fix (commit 204a7fe91f) was already present in the release. Th..."
    }
  ]
}