{"id":"CVE-2020-5397","details":"Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.","aliases":["GHSA-7pm4-g2qj-j85x"],"modified":"2026-07-07T08:51:39.094670512Z","published":"2020-01-17T19:15:14.727Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"8.0.0"},{"last_affected":"8.2.2"}],"source":"CPE_RANGE","vendor_product":"oracle:communications_diameter_signaling_router","cpes":["cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*"]},{"extracted_events":[{"introduced":"11.0.0"},{"last_affected":"11.3.1"}],"source":"CPE_RANGE","vendor_product":"oracle:insurance_calculation_engine","cpes":["cpe:2.3:a:oracle:insurance_calculation_engine:*:*:*:*:*:*:*:*"]},{"source":"CPE_RANGE","vendor_product":"oracle:mysql_enterprise_monitor","cpes":["cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.0.0"},{"last_affected":"4.0.12"},{"introduced":"8.0.0"},{"last_affected":"8.0.20"}]},{"source":"CPE_STRING","vendor_product":"oracle:application_testing_suite","cpes":["cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.3.0.1"},{"last_affected":"13.3.0.1"}]},{"source":"CPE_STRING","vendor_product":"oracle:communications_brm_-_elastic_charging_engine","cpes":["cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11.3"},{"last_affected":"11.3"},{"introduced":"12.0"},{"last_affected":"12.0"}]},{"vendor_product":"oracle:communications_element_manager","cpes":["cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.1.1"},{"last_affected":"8.1.1"},{"introduced":"8.2.0"},{"last_affected":"8.2.0"},{"introduced":"8.2.1"},{"last_affected":"8.2.1"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"12.5.0"},{"last_affected":"12.5.0"}],"source":"CPE_STRING","vendor_product":"oracle:communications_policy_management","cpes":["cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.1.1"},{"last_affected":"8.1.1"},{"introduced":"8.2.0"},{"last_affected":"8.2.0"},{"introduced":"8.2.1"},{"last_affected":"8.2.1"}],"source":"CPE_STRING","vendor_product":"oracle:communications_session_route_manager"},{"cpes":["cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.1.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.2.1.0"},{"last_affected":"13.2.1.0"}],"source":"CPE_STRING","vendor_product":"oracle:enterprise_manager_base_platform"},{"cpes":["cpe:2.3:a:oracle:financial_services_regulatory_reporting_with_agilereporter:8.0.9.2.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.9.2.0"},{"last_affected":"8.0.9.2.0"}],"source":"CPE_STRING","vendor_product":"oracle:financial_services_regulatory_reporting_with_agilereporter"},{"vendor_product":"oracle:flexcube_private_banking","cpes":["cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.0.0"},{"last_affected":"12.0.0"},{"introduced":"12.1.0"},{"last_affected":"12.1.0"}],"source":"CPE_STRING"},{"vendor_product":"oracle:healthcare_master_person_index","cpes":["cpe:2.3:a:oracle:healthcare_master_person_index:4.0.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.0.2"},{"last_affected":"4.0.2"}],"source":"CPE_STRING"},{"vendor_product":"oracle:insurance_policy_administration_j2ee","cpes":["cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.4:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.2.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"10.2.0"},{"last_affected":"10.2.0"},{"introduced":"10.2.4"},{"last_affected":"10.2.4"},{"introduced":"11.0.2"},{"last_affected":"11.0.2"},{"introduced":"11.1.0"},{"last_affected":"11.1.0"},{"introduced":"11.2.0"},{"last_affected":"11.2.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","vendor_product":"oracle:insurance_rules_palette","cpes":["cpe:2.3:a:oracle:insurance_rules_palette:10.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_rules_palette:10.2.4:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_rules_palette:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:insurance_rules_palette:11.2.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"10.2.0"},{"last_affected":"10.2.0"},{"introduced":"10.2.4"},{"last_affected":"10.2.4"},{"introduced":"11.0.2"},{"last_affected":"11.0.2"},{"introduced":"11.1.0"},{"last_affected":"11.1.0"},{"introduced":"11.2.0"},{"last_affected":"11.2.0"}]},{"cpes":["cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1"},{"last_affected":"12.1"},{"introduced":"12.2"},{"last_affected":"12.2"}],"source":"CPE_STRING","vendor_product":"oracle:rapid_planning"},{"extracted_events":[{"introduced":"15.0"},{"last_affected":"15.0"},{"introduced":"16.0"},{"last_affected":"16.0"}],"source":"CPE_STRING","vendor_product":"oracle:retail_assortment_planning","cpes":["cpe:2.3:a:oracle:retail_assortment_planning:15.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_assortment_planning:16.0:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.1"},{"last_affected":"14.1"}],"source":"CPE_STRING","vendor_product":"oracle:retail_back_office"},{"cpes":["cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.1"},{"last_affected":"14.1"}],"source":"CPE_STRING","vendor_product":"oracle:retail_central_office"},{"source":"CPE_STRING","vendor_product":"oracle:retail_financial_integration","cpes":["cpe:2.3:a:oracle:retail_financial_integration:15.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_financial_integration:16.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.0"},{"last_affected":"15.0"},{"introduced":"16.0"},{"last_affected":"16.0"}]},{"extracted_events":[{"introduced":"15.0.3"},{"last_affected":"15.0.3"},{"introduced":"16.0.3"},{"last_affected":"16.0.3"}],"source":"CPE_STRING","vendor_product":"oracle:retail_integration_bus","cpes":["cpe:2.3:a:oracle:retail_integration_bus:15.0.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:*"]},{"extracted_events":[{"introduced":"15.0"},{"last_affected":"15.0"},{"introduced":"16.0"},{"last_affected":"16.0"}],"source":"CPE_STRING","vendor_product":"oracle:retail_order_broker","cpes":["cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"oracle:retail_point-of-service","cpes":["cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.1"},{"last_affected":"14.1"}]},{"cpes":["cpe:2.3:a:oracle:retail_predictive_application_server:14.0.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.0.3"},{"last_affected":"14.0.3"},{"introduced":"14.1.3"},{"last_affected":"14.1.3"},{"introduced":"15.0.3.0"},{"last_affected":"15.0.3.0"},{"introduced":"16.0.3.0"},{"last_affected":"16.0.3.0"}],"source":"CPE_STRING","vendor_product":"oracle:retail_predictive_application_server"},{"cpes":["cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.1"},{"last_affected":"14.1"}],"source":"CPE_STRING","vendor_product":"oracle:retail_returns_management"},{"cpes":["cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.0"},{"last_affected":"15.0"},{"introduced":"16.0"},{"last_affected":"16.0"}],"source":"CPE_STRING","vendor_product":"oracle:retail_service_backbone"},{"extracted_events":[{"introduced":"12.2.1.3.0"},{"last_affected":"12.2.1.3.0"},{"introduced":"12.2.1.4.0"},{"last_affected":"12.2.1.4.0"}],"source":"CPE_STRING","vendor_product":"oracle:weblogic_server","cpes":["cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"FIX","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujul2020.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2020.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"},{"type":"EVIDENCE","url":"https://pivotal.io/security/cve-2020-5397"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/spring-projects/spring-framework","events":[{"introduced":"927b8c15ef20eaaa4002d4b2170cc536a6d6aa35"},{"fixed":"0ddc62e87f9e0c9fb664ba085bcdf7ca61e697dd"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.2.0"},{"fixed":"5.2.3"}]}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-5397.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}