CVE-2020-5421: spring framework before 4.3.29 (exclusive), from 5.0.0 (inclusive), before 5.0.19 (exclusive), from 5.1.0 (inclusive)…

Affected technology

spring framework · before 4.3.29 (exclusive)
vmware

spring framework · from 5.0.0 (inclusive), before 5.0.19 (exclusive)
vmware

spring framework · from 5.1.0 (inclusive), before 5.1.18 (exclusive)
vmware

spring framework · from 5.2.0 (inclusive), before 5.2.9 (exclusive)
vmware

commerce guided search · 11.3.2
oracle

communications brm · 11.3.0.9
oracle

communications brm · 12.0.0.3
oracle

communications design studio · 7.3.4
oracle

communications design studio · 7.3.5
oracle

communications design studio · 7.4.0
oracle

communications session report manager · from 8.2.1 (inclusive), through 8.2.2.1 (inclusive)
oracle

communications unified inventory management · 7.3.4
oracle

communications unified inventory management · 7.3.5
oracle

endeca information discovery integrator · 3.2.0
oracle

enterprise data quality · 12.2.1.3.0
oracle

enterprise data quality · 12.2.1.4.0
oracle

financial services analytical applications infrastructure · from 8.0.6 (inclusive), through 8.1.0 (inclusive)
oracle

flexcube private banking · 12.0.0
oracle

flexcube private banking · 12.1.0
oracle

fusion middleware · 12.2.1.3.0
oracle

fusion middleware · 12.2.1.4.0
oracle

goldengate application adapters · 19.1.0.0.0
oracle

healthcare master person index · 4.0.2.5
oracle

hyperion infrastructure technology · 11.1.2.4
oracle

insurance policy administration · from 11.1.0 (inclusive), through 11.3.0 (inclusive)
oracle

insurance policy administration · 10.2
oracle

insurance policy administration · 10.2.4
oracle

insurance policy administration · 11.0.2
oracle

insurance rules palette · from 11.1.0 (inclusive), through 11.3.0 (inclusive)
oracle

insurance rules palette · 10.2.0
oracle

insurance rules palette · 10.2.4
oracle

insurance rules palette · 11.0.2
oracle

mysql enterprise monitor · through 8.0.22 (inclusive)
oracle

mysql enterprise monitor · 8.0.23
oracle

primavera gateway · from 16.2.0 (inclusive), through 16.2.11 (inclusive)
oracle

primavera gateway · from 17.12.0 (inclusive), through 17.12.9 (inclusive)
oracle

primavera gateway · from 18.8.0 (inclusive), through 18.8.10 (inclusive)
oracle

primavera gateway · from 19.12.0 (inclusive), through 19.12.10 (inclusive)
oracle

primavera p6 enterprise project portfolio management · from 16.1.0 (inclusive), through 16.2.20 (inclusive)
oracle

primavera p6 enterprise project portfolio management · from 17.1.0 (inclusive), through 17.12.19 (inclusive)
oracle

primavera p6 enterprise project portfolio management · from 18.1.0 (inclusive), through 18.8.21 (inclusive)
oracle

primavera p6 enterprise project portfolio management · from 19.12.0 (inclusive), through 19.12.10 (inclusive)
oracle

retail assortment planning · 16.0.3.0
oracle

retail bulk data integration · 16.0.3.0
oracle

retail customer engagement · from 16.0 (inclusive), through 19.0 (inclusive)
oracle

retail customer management and segmentation foundation · from 16.0 (inclusive), through 19.0 (inclusive)
oracle

retail financial integration · 14.1.3
oracle

retail financial integration · 15.0.3
oracle

retail financial integration · 16.0.3
oracle

retail integration bus · 14.1.3
oracle

retail integration bus · 15.0.3
oracle

retail integration bus · 16.0.3
oracle

retail invoice matching · 14.0
oracle

retail invoice matching · 14.1
oracle

retail merchandising system · 16.0.3
oracle

retail order broker · 15.0
oracle

retail order broker · 16.0
oracle

retail predictive application server · 14.1
oracle

retail returns management · 14.1
oracle

retail service backbone · 14.1.3
oracle

retail service backbone · 15.0.3
oracle

retail service backbone · 16.0.3
oracle

retail xstore point of service · 15.0.4
oracle

retail xstore point of service · 16.0.6
oracle

retail xstore point of service · 17.0.4
oracle

retail xstore point of service · 18.0.3
oracle

retail xstore point of service · 19.0.2
oracle

storagetek acsls · 8.5.1
oracle

storagetek tape analytics sw tool · 2.3
oracle

weblogic server · 10.3.6.0.0
oracle

weblogic server · 12.1.3.0.0
oracle

weblogic server · 12.2.1.3.0
oracle

weblogic server · 12.2.1.4.0
oracle

weblogic server · 14.1.1.0.0
oracle

oncommand insight · Version not applicable in the source CPE
netapp

snap creator framework · Version not applicable in the source CPE
netapp

snapcenter · Version not applicable in the source CPE
netapp

Spring Framework · 4.3 to before 4.3.29, 5.0 to before 5.0.19, 5.1 to before 5.1.18, 5.2 to before 5.2.9
Spring by VMware

Description’s affected range: versions 5.2.0 - 5.2.8

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

NVD’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality impact as low; integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.