9.3
CVSSv2

CVE-2015-5211

Published: 25/05/2017 Updated: 05/06/2022
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
CVSS v3 Base Score: 9.6 | Impact Score: 6 | Exploitability Score: 2.8
VMScore: 829
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

vmware spring framework 3.2.2

vmware spring framework 3.2.1

vmware spring framework 3.2.8

vmware spring framework 3.2.7

vmware spring framework 3.2.10

vmware spring framework 3.2.9

vmware spring framework 3.2.4

vmware spring framework 3.2.3

vmware spring framework 3.2.6

vmware spring framework 3.2.5

vmware spring framework 4.0.1

vmware spring framework 4.0.6

vmware spring framework 4.0.8

vmware spring framework 3.2.14

vmware spring framework 4.2.1

vmware spring framework 4.1.6

vmware spring framework 4.0.2

vmware spring framework 4.0.3

vmware spring framework 4.0.4

vmware spring framework 4.0.5

vmware spring framework 3.2.11

vmware spring framework 3.2.12

vmware spring framework 4.1.1

vmware spring framework 4.1.2

vmware spring framework 4.1.3

vmware spring framework 4.0.7

vmware spring framework 4.0.9

vmware spring framework 3.2.13

vmware spring framework 4.1.5

vmware spring framework 4.1.7

vmware spring framework 4.1.4

vmware spring framework 3.2.0

vmware spring framework 4.1.0

vmware spring framework 4.0.0

vmware spring framework 4.2.0

debian debian linux 8.0

Github Repositories

Java-spring-web

Java Spring Web 목차 1 스프링 MVC 1 MVC 코드 예제 2 서블릿 소개 1 서블릿 코드 3 스프링 IoC 컨테이너 연동 1 DispatcherServlet 4 DispatcherServlet 동작 원리 5 DispatcherServlet 1 DispatcherServlet View 존재하는 경우 2 다른방식의 등록 6 커스텀 ViewRe

Spring 安全漏洞 CVE-2020-5421复现

Spring 安全漏洞 CVE-2020-5421复现 漏洞概述 CVE-2020-5421 可通过jsessionid路径参数,绕过防御RFD攻击的保护。先前针对RFD的防护是为应对 CVE-2015-5211 添加的。 什么是RFD 反射型文件下载漏洞(RFD)是一种攻击技术,通过从受信任的域虚拟下载文件,攻击者可以获得对受害者计算机的完全访问权限。