boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2020-5398

CVE-2020-5398HIGH
Spring Spring Framework — RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   R  U  H  H  H    7.5   .8877   99.8     —
AFFECTED
  Product           Versions  Fixed
  Spring Framework  5.0 –     —
TIMELINE
  Jan 3   Reserved by pivotal
  Jan 16  Published (CNA: pivotal)
  Oct 8   RESCORED — CVE-2020-5398 (Spring Framework). CVSS 8 → 7.5 (NVD).
CWE-494, CWE-79 · CNA: pivotal · CVSS v3.1 · 44 references · NVD status: Modified

Description

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
January 3, 2020ReservedReserved by pivotal
January 16, 2020PublishedPublished (CNA: pivotal)
October 8, 2026RESCOREDRESCORED — CVE-2020-5398 (Spring Framework). CVSS 8 → 7.5 (NVD).

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
SpringSpring Framework—5.0—

Weaknesses

CWE-494 · CWE-79

References (44)

Related

Authoritative record: CVE-2020-5398 at cve.org

Vendors: spring

Weaknesses: CWE-494 · CWE-79

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2020-5398 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.