{
  "@id": "urn:uuid:8d36a3e1-611f-474c-b509-fbdebceda5b1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:48:25.809682+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T23:48:25.809682+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.1.7-tuxcare.3 of org.springframework:spring-framework-bom. not_affected \u2014 Target Spring Framework 6.1.7 is not affected by CVE-2020-5421. The vulnerability (bypass of RFD attack protections via jsessionid path parameters) was fixed in upstream Spring Framework 5.x releases in October 2020 by Rossen Stoyanchev. The fix reinstated automatic removal of jsessionid from request URIs. Spring Framework 6.1.7, released in 2024, ships with the complete fix: UrlPathHelper.remo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 Target Spring Framework 6.1.7 is not affected by CVE-2020-5421. The vulnerability (bypass of RFD attack protections via jsessionid path parameters) was fixed in upstream Spring Framework 5.x releases in October 2020 by Rossen Stoyanchev. The fix reinstated automatic removal of jsessionid from request URIs. Spring Framework 6.1.7, released in 2024, ships with the complete fix: UrlPathHelper.remo..."
    }
  ]
}