{
  "@id": "urn:uuid:10e357e7-55c5-4583-ae52-a5862bbdcd5b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T00:10:21.268566+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.2.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.2.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T00:10:21.268566+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.2.14-tuxcare.1 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 is not present in Spring Framework 6.2.14. The vulnerability involved a bypass of RFD (Reflected File Download) protections where jsessionid path parameters could interfere with file extension detection when semicolon content removal was disabled. The fix (commit eb11c6fa23 by Rossen Stoyanchev) was already present in the upstream Spring Framework 6.2.14 release that TuxCare onboa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 is not present in Spring Framework 6.2.14. The vulnerability involved a bypass of RFD (Reflected File Download) protections where jsessionid path parameters could interfere with file extension detection when semicolon content removal was disabled. The fix (commit eb11c6fa23 by Rossen Stoyanchev) was already present in the upstream Spring Framework 6.2.14 release that TuxCare onboa..."
    }
  ]
}