CVE-2020-5398: spring framework from 5.0.0 (inclusive), before 5.0.16 (exclusive), from 5.1.0 (inclusive), before 5.1.13 (exclusive)…

Affected technology

spring framework · from 5.0.0 (inclusive), before 5.0.16 (exclusive)
vmware

spring framework · from 5.1.0 (inclusive), before 5.1.13 (exclusive)
vmware

spring framework · from 5.2.0 (inclusive), before 5.2.3 (exclusive)
vmware

application testing suite · 13.3.0.1
oracle

communications billing and revenue management elastic charging engine · 11.3
oracle

communications billing and revenue management elastic charging engine · 12.0
oracle

communications cloud native core policy · 1.5.0
oracle

communications diameter signaling router · from 8.0.0 (inclusive), through 8.2.2 (inclusive)
oracle

communications element manager · 8.1.1
oracle

communications element manager · 8.2.0
oracle

communications element manager · 8.2.1
oracle

communications policy management · 12.5.0
oracle

communications session report manager · 8.1.1
oracle

communications session report manager · 8.2.0
oracle

communications session report manager · 8.2.1
oracle

communications session route manager · 8.1.1
oracle

communications session route manager · 8.2.0
oracle

communications session route manager · 8.2.1
oracle

enterprise manager base platform · 13.2.1.0
oracle

financial services regulatory reporting with agilereporter · 8.0.9.2.0
oracle

flexcube private banking · 12.0.0
oracle

flexcube private banking · 12.1.0
oracle

healthcare master person index · 4.0.2
oracle

insurance calculation engine · from 11.0.0 (inclusive), through 11.3.1 (inclusive)
oracle

insurance policy administration j2ee · 10.2.0
oracle

insurance policy administration j2ee · 10.2.4
oracle

insurance policy administration j2ee · 11.0.2
oracle

insurance policy administration j2ee · 11.1.0
oracle

insurance policy administration j2ee · 11.2.0
oracle

insurance policy administration j2ee · 11.2.2.0
oracle

insurance rules palette · 10.2.0
oracle

insurance rules palette · 10.2.4
oracle

insurance rules palette · 11.0.2
oracle

insurance rules palette · 11.1.0
oracle

insurance rules palette · 11.2.0
oracle

mysql · from 4.0.0 (inclusive), through 4.0.12 (inclusive)
oracle

mysql · from 8.0.0 (inclusive), through 8.0.20 (inclusive)
oracle

rapid planning · 12.1
oracle

rapid planning · 12.2
oracle

retail assortment planning · 15.0
oracle

retail assortment planning · 16.0
oracle

retail back office · 14.1
oracle

retail bulk data integration · 16.0.3.0
oracle

retail central office · 14.1
oracle

retail financial integration · 15.0
oracle

retail financial integration · 16.0
oracle

retail integration bus · 15.0.3
oracle

retail integration bus · 16.0.3
oracle

retail order broker · 15.0
oracle

retail order broker · 16.0
oracle

retail point-of-service · 14.1
oracle

retail predictive application server · 14.0.3
oracle

retail predictive application server · 14.1.3.0
oracle

retail predictive application server · 15.0.3
oracle

retail predictive application server · 16.0.3.0
oracle

retail returns management · 14.1
oracle

retail service backbone · 15.0
oracle

retail service backbone · 16.0
oracle

siebel engineering - installer & deployment · through 2.1.1 (inclusive)
oracle

weblogic server · 12.2.1.3.0
oracle

weblogic server · 12.2.1.4.0
oracle

data availability services · Version not applicable in the source CPE
netapp

snapcenter · Version not applicable in the source CPE
netapp

Spring Framework · 5.0 to before v5.0.16.RELEASE, 5.1 to before v5.1.13.RELEASE, 5.2 to before v5.2.3.RELEASE
Spring

Description’s affected range: versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.