Medium
CVE-2020-5421 — RFD Protection Bypass via jsessionid
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
17
Low
Who exploits it and how urgent it is
A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.
No exploitation signal in the sources consulted so far.
How the score was calculated
- EPSS 11.6% (30-day exploitation probability)+14
- Technical severity (medium)+3
The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.
Exploitation
Not confirmed
Not in CISA KEV — an absence of record, not proof it is unexploited.
EPSS FIRST
11.56%
ahead of 96% of scored CVEs · Oct 15, 2026
Affects
Netapp
Oncommand Insight and 37 more
CVSS base
6.5
Medium · 3 source(s)
Prioritization reference: 8.7 provisional
CISA SSVC assessment CISA
Three decision points CISA publishes for the CVEs it assesses (SSVC 2.0.3). A stakeholder decision, not a severity score.
Exploitation
None
none · proof-of-concept · active
Automatable
No
can an attacker script the kill-chain steps
Technical impact
Partial
partial · total control of the vulnerable component
Remediation
Fixes and mitigations documented by the sources — linked to the original advisory.
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
- Documented patch — www.oracle.com (NIST National Vulnerability Database)
First 24 hours
Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.
- Identify exposed assets running the affected vendor/product/version combinations (Netapp Oncommand Insight, Netapp Snap Creator Framework, Netapp Snapcenter…).
- Apply the fixed version or the patch documented under Remediation.
- Exploitation requires user interaction: tighten email/web filtering and warn affected users.
- EPSS ahead of 96% of scored CVEs: prioritize it in the patch queue.
- Search available logs for exploit probes, errors and authentication anomalies.
Affected scope
Vendor, product and versions as the sources word them.
| Vendor | Product | Versions | Status | Source |
|---|---|---|---|---|
| Netapp | Oncommand Insight | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Netapp | Snap Creator Framework | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Netapp | Snapcenter | versions not specified by the source | Vulnerable | NIST National Vulnerability Database |
| Oracle | Commerce Guided Search | version 11.3.2 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Communications Brm | version 11.3.0.9version 12.0.0.3 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Communications Design Studio | version 7.4.0version 7.3.5version 7.3.4 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Communications Session Report Manager | ≥ 8.2.1 and ≤ 8.2.2.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Communications Unified Inventory Management | version 7.3.5version 7.3.4 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Endeca Information Discovery Integrator | version 3.2.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Enterprise Data Quality | version 12.2.1.4.0version 12.2.1.3.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Financial Services Analytical Applications Infrastructure | ≥ 8.0.6 and ≤ 8.1.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Flexcube Private Banking | version 12.0.0version 12.1.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Fusion Middleware | version 12.2.1.4.0version 12.2.1.3.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Goldengate Application Adapters | version 19.1.0.0.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Healthcare Master Person Index | version 4.0.2.5 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Hyperion Infrastructure Technology | version 11.1.2.4 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Insurance Policy Administration | version 11.0.2version 10.2.4≥ 11.1.0 and ≤ 11.3.0version 10.2 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Insurance Rules Palette | version 11.0.2version 10.2.4version 10.2.0≥ 11.1.0 and ≤ 11.3.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Mysql Enterprise Monitor | ≤ 8.0.22version 8.0.23 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Primavera Gateway | ≥ 17.12.0 and ≤ 17.12.9≥ 16.2.0 and ≤ 16.2.11≥ 18.8.0 and ≤ 18.8.10≥ 19.12.0 and ≤ 19.12.10 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Primavera P6 Enterprise Project Portfolio Management | ≥ 16.1.0 and ≤ 16.2.20≥ 17.1.0 and ≤ 17.12.19≥ 18.1.0 and ≤ 18.8.21≥ 19.12.0 and ≤ 19.12.10 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Assortment Planning | version 16.0.3.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Bulk Data Integration | version 16.0.3.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Customer Engagement | ≥ 16.0 and ≤ 19.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Customer Management And Segmentation Foundation | ≥ 16.0 and ≤ 19.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Financial Integration | version 16.0.3version 15.0.3version 14.1.3 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Integration Bus | version 16.0.3version 15.0.3version 14.1.3 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Invoice Matching | version 14.1version 14.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Merchandising System | version 16.0.3 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Order Broker | version 16.0version 15.0 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Predictive Application Server | version 14.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Returns Management | version 14.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Service Backbone | version 16.0.3version 15.0.3version 14.1.3 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Retail Xstore Point Of Service | version 15.0.4version 17.0.4version 18.0.3version 19.0.2version 16.0.6 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Storagetek Acsls | version 8.5.1 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Storagetek Tape Analytics Sw Tool | version 2.3 | Vulnerable | NIST National Vulnerability Database |
| Oracle | Weblogic Server | version 14.1.1.0.0version 10.3.6.0.0version 12.1.3.0.0version 12.2.1.3.0version 12.2.1.4.0 | Vulnerable | NIST National Vulnerability Database |
| Spring by VMware | Spring Framework | ≥ 4.3 and < 4.3.29≥ 5.0 and < 5.0.19≥ 5.1 and < 5.1.18≥ 5.2 and < 5.2.9 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| Vmware | Spring Framework | < 4.3.29≥ 5.0.0 and < 5.0.19≥ 5.1.0 and < 5.1.18≥ 5.2.0 and < 5.2.9 | Vulnerable | NIST National Vulnerability Database |
Attack characteristics
The CVSS vector, decoded. It describes the attack, not your exposure to it.
Attack vector
Network
Attack complexity
High
Privileges required
Low
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
None
Every base score collected
Sources score independently and may disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Scored by |
|---|---|---|---|---|---|
| 6.5 | CVSS 3.1 | Medium | 1.3 | 4.7 | nvd@nist.gov via NIST National Vulnerability Database |
| 8.7 | CVSS 3.0 | High | 2.3 | 5.8 | security@pivotal.io via NIST National Vulnerability Database |
| 8.7 | CVSS 3.0 | High | — | — | pivotal via CVE Program (cve.org) e CISA ADP |
| 3.6 | CVSS 2.0 | Low | 3.9 | 4.9 | nvd@nist.gov via NIST National Vulnerability Database |
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N (score shown at the top: nvd@nist.gov)
Scoring entities (NIST, CNA, ADP) score independently; each score is shown with its origin. For prioritization we use 8.7 (security@pivotal.io via NIST National Vulnerability Database) as a conservative provisional reference — not a definitive official score.
EPSS over time FIRST
Oct 13, 2026 → Oct 15, 2026 · 3 reading(s) · max 11.56%
Detection
Read off the CVSS vector and the weakness class. Starting points, not tested rules.
- Prioritize edge telemetry for the network-reachable component (proxy, WAF, IDS/IPS).
Timeline
What happened to this CVE, newest first.
- 2026
- Affected products added · spring by vmware/spring framework
- SSVC assessment updated
- Record published
- Fix documented
- CVSS changed · 6.5
- Source status changed · → Modified
- Record created in this database
- 2020
- CVE published
Source activity
Repeated readings are counted rather than listed.
- 1× Official description updated · Oct 13, 2026 – Oct 13, 2026
References
24 on the record
- tanzu.vmware.com/security/cve-2020-5421
- www.oracle.com//security-alerts/cpujul2021.html
- www.oracle.com/security-alerts/cpujan2022.html
- www.oracle.com/security-alerts/cpuapr2022.html
- www.oracle.com/security-alerts/cpuApr2021.html
- www.oracle.com/security-alerts/cpujan2021.html
- www.oracle.com/security-alerts/cpuoct2021.html
- lists.apache.org/thread.html/r3589ed0d18edeb79028615080d5a0e8878856436bb91774a3196d9eb
- lists.apache.org/thread.html/r918caad55dcc640a16753b00d8d6acb90b4e36de4b6156d0867246ec
- lists.apache.org/thread.html/re014a49d77f038ba70e5e9934d400af6653e8c9ac110d32b1254127e
- lists.apache.org/thread.html/rc9efaf6db98bee19db1bc911d0fa442287dac5cb229d4aaa08b6a13d
- lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5
- lists.apache.org/thread.html/rb18ed999153ef0f0cb7af03efe0046c42c7242fd77fbd884a75ecfdc
- lists.apache.org/thread.html/raf7ca57033e537e4f9d7df7f192fa6968c1e49409b2348e08d807ccb
- security.netapp.com/advisory/ntap-20210513-0009/
- lists.apache.org/thread.html/rd462a8b0dfab4c15e67c0672cd3c211ecd0e4f018f824082ed54f665
- lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1
- lists.apache.org/thread.html/rf00d8f4101a1c1ea4de6ea1e09ddf7472cfd306745c90d6da87ae074
- lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163
- lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a
- lists.apache.org/thread.html/r7e6a213eea7f04fc6d9e3bd6eb8d68c4df92a22e956e95cb2c482865
- lists.apache.org/thread.html/ra889d95141059c6cbe77dd80249bb488ae53b274b5f3abad09d9511d
- lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a
- lists.apache.org/thread.html/r503e64b43a57fd68229cac4a869d1a9a2eac9e75f8719cad3a840211
Elsewhere on this site
Related CVEs (same products)
- Critical CVE-2026-83038 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component:... Sep 15, 2026
- Critical CVE-2026-83021 Improper Authentication in Oracle Weblogic Server Sep 15, 2026
- Critical CVE-2026-70748 Improper Authentication in Oracle Weblogic Server Sep 15, 2026
- Critical CVE-2026-70757 Improper Authentication in Oracle Weblogic Server Sep 15, 2026
- Critical CVE-2026-70756 Improper Authentication in Oracle Weblogic Server Sep 15, 2026
- Critical CVE-2026-59313 Server Sent Event stream corruption in Spring MVC functional web framework Aug 27, 2026
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No CWE classification.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.
Answered from this record
Text assembled only from the fields above — no additional claims.
What should defenders know first?
CVE-2020-5421 is "RFD Protection Bypass via jsessionid", rated Medium. It affects Oncommand Insight (Netapp); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 6.5 describes technical severity. EPSS 11.56% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.
Comments
Moderated technical discussion. Read the community guidelines.
No comments yet.
Sign in or create an account to comment and suggest corrections.