CVEs-PoC/2020/CVE-2020-5421.md

CVE-2020-5421

Description

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

POC

Reference

• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuoct2021.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Dzmitry-Basiachenka/dist-foreign-aliakh
• https://github.com/Ljw1114/SpringFramework-Vul
• https://github.com/ax1sX/SpringSecurity
• https://github.com/delaval-htps/ProjetDevJava
• https://github.com/developer3000S/PoC-in-GitHub
• https://github.com/emilywang0/CVE_testing_VULN
• https://github.com/emilywang0/MergeBase_test_vuln
• https://github.com/fulln/TIL
• https://github.com/nBp1Ng/FrameworkAndComponentVulnerabilities
• https://github.com/nBp1Ng/SpringFramework-Vul
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/pandaMingx/CVE-2020-5421
• https://github.com/scordero1234/java_sec_demo-main
• https://github.com/soosmile/POC
• https://github.com/x-f1v3/Vulnerability_Environment