{
  "@id": "urn:uuid:50d01cca-b969-4fe8-bb4e-54b631ed2f44",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:46:07.863091+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.2.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.2.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T23:46:07.863091+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 concerns RFD (Reflected File Download) attack bypass via jsessionid path parameters. The target Spring Framework 6.2.19-tuxcare.3 is NOT affected because the upstream fix was already present in the Spring Framework 6.2.19 release that TuxCare onboarded. The fix ensures jsessionid path parameters are always stripped from request URIs during path processing, preventing them from byp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 concerns RFD (Reflected File Download) attack bypass via jsessionid path parameters. The target Spring Framework 6.2.19-tuxcare.3 is NOT affected because the upstream fix was already present in the Spring Framework 6.2.19 release that TuxCare onboarded. The fix ensures jsessionid path parameters are always stripped from request URIs during path processing, preventing them from byp..."
    }
  ]
}