{
  "@id": "urn:uuid:79f76f98-319e-492a-93c6-648d94371e09",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T00:11:56.652286+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T00:11:56.652286+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.2.7-tuxcare.1 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework version 6.2.7-tuxcare.2 is NOT affected by CVE-2020-5421. The vulnerability involved jsessionid path parameters bypassing RFD (Reflected File Download) protections. The target repository already contains the complete upstream fix that was shipped in Spring Framework 6.2.7, prior to TuxCare's onboarding. The fix ensures jsessionid parameters are always removed from request URIs ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 Spring Framework version 6.2.7-tuxcare.2 is NOT affected by CVE-2020-5421. The vulnerability involved jsessionid path parameters bypassing RFD (Reflected File Download) protections. The target repository already contains the complete upstream fix that was shipped in Spring Framework 6.2.7, prior to TuxCare's onboarding. The fix ensures jsessionid parameters are always removed from request URIs ..."
    }
  ]
}