Spring by VMware vulnerabilities
Published CVEs affecting Spring by VMware products: 2 record(s), with severity, exploitation and fixes.
CVE-2020-5421
Medium · 6.5
Sep 19, 2020
RFD Protection Bypass via jsessionid
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
CVE-2020-5410
High · 7.5
KEV Urgent · 75 Public exploit CWE-22 Jun 2, 2020
VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.