{
  "@id": "urn:uuid:586af5cb-fa3d-457a-ae99-4827dc5ff9a4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 31,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T00:09:43.080339+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T00:09:43.080339+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 is NOT present in Spring Framework 6.2.3. The vulnerability, which allowed RFD (Reflected File Download) attacks to bypass protections by using jsessionid path parameters, was fixed by upstream Spring Framework developers before the 6.2.3 release. The fix includes: (1) a removeJsessionid() method in UrlPathHelper that strips jsessionid parameters from request URIs regardless of se...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 is NOT present in Spring Framework 6.2.3. The vulnerability, which allowed RFD (Reflected File Download) attacks to bypass protections by using jsessionid path parameters, was fixed by upstream Spring Framework developers before the 6.2.3 release. The fix includes: (1) a removeJsessionid() method in UrlPathHelper that strips jsessionid parameters from request URIs regardless of se..."
    }
  ]
}