{
  "@id": "urn:uuid:2861d3e7-f33d-4994-8587-b5fdee3c704c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 30,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:46:00.086254+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.2.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.2.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T23:46:00.086254+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.2.1-tuxcare.4 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 does not affect Spring Framework 6.2.1-tuxcare.6. The vulnerability involves bypassing RFD (Reflected File Download) protections via jsessionid path parameters. The fix that ensures jsessionid removal was part of the upstream Spring Framework 6.2.1 release, which TuxCare then onboarded. The target contains the defensive code: UrlPathHelper.removeJsessionid() (lines 631-645) always...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 does not affect Spring Framework 6.2.1-tuxcare.6. The vulnerability involves bypassing RFD (Reflected File Download) protections via jsessionid path parameters. The fix that ensures jsessionid removal was part of the upstream Spring Framework 6.2.1 release, which TuxCare then onboarded. The target contains the defensive code: UrlPathHelper.removeJsessionid() (lines 631-645) always..."
    }
  ]
}