CVE-2020-5398

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2020-5398
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-5398.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-5398
Aliases
Downstream
Related
Published
2020-01-17T00:15:12.103Z
Modified
2025-11-14T11:10:53.263346Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

References

Affected packages

Git / github.com/mysql/mysql-server

Affected ranges

Type
GIT
Repo
https://github.com/mysql/mysql-server
Events
Introduced
f9e2c6cd27268e72198bde3c1a71eb1273df335a
Fixed
a50cc250ffff75eb1a52f9dfeb90a391e1a04cf9

Affected versions

mysql-4.*

mysql-4.0.18
mysql-4.0.19
mysql-4.0.20
mysql-4.0.21
mysql-4.0.22
mysql-4.0.23
mysql-4.0.24
mysql-4.0.25
mysql-4.0.26
mysql-4.1.10
mysql-4.1.10a
mysql-4.1.10b
mysql-4.1.11
mysql-4.1.12
mysql-4.1.13
mysql-4.1.13a
mysql-4.1.14
mysql-4.1.15
mysql-4.1.2
mysql-4.1.3
mysql-4.1.4
mysql-4.1.5
mysql-4.1.6
mysql-4.1.7
mysql-4.1.8
mysql-4.1.9

mysql-5.*

mysql-5.0.0
mysql-5.0.1
mysql-5.0.10
mysql-5.0.10a
mysql-5.0.11
mysql-5.0.12
mysql-5.0.13
mysql-5.0.14
mysql-5.0.15
mysql-5.0.16
mysql-5.0.2
mysql-5.0.2-alpha
mysql-5.0.3
mysql-5.0.4
mysql-5.0.5
mysql-5.0.6
mysql-5.0.7
mysql-5.0.8
mysql-5.0.9

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2020-5398-005f30d4",
        "source": "https://github.com/mysql/mysql-server/commit/a50cc250ffff75eb1a52f9dfeb90a391e1a04cf9",
        "digest": {
            "line_hashes": [
                "286320303339749738648665452293868188132",
                "257324391713171244827191068720724484049",
                "283579218541017171684689494770732785154",
                "135831442793539143719651860588652735777"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "client/mysqldump.c"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2020-5398-373ae2f3",
        "source": "https://github.com/mysql/mysql-server/commit/a50cc250ffff75eb1a52f9dfeb90a391e1a04cf9",
        "digest": {
            "line_hashes": [
                "332426695089840650221473020143658201782",
                "163213773102795387028649232479366975830",
                "283579218541017171684689494770732785154",
                "135831442793539143719651860588652735777"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "client/mysqlbinlog.cc"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2020-5398-4f4bb365",
        "source": "https://github.com/mysql/mysql-server/commit/a50cc250ffff75eb1a52f9dfeb90a391e1a04cf9",
        "digest": {
            "line_hashes": [
                "332426695089840650221473020143658201782",
                "163213773102795387028649232479366975830",
                "283579218541017171684689494770732785154",
                "4460628275193876015680143352103219177"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "client/mysqlshow.c"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2020-5398-59801507",
        "source": "https://github.com/mysql/mysql-server/commit/a50cc250ffff75eb1a52f9dfeb90a391e1a04cf9",
        "digest": {
            "line_hashes": [
                "259777894433241742399784240979398548086",
                "103739100402833506015429806307603891025",
                "122411845626865646047612466049667578395",
                "196062272697173995273915347355961836570"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "netware/mysql_test_run.c"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2020-5398-794b21da",
        "source": "https://github.com/mysql/mysql-server/commit/a50cc250ffff75eb1a52f9dfeb90a391e1a04cf9",
        "digest": {
            "line_hashes": [
                "332426695089840650221473020143658201782",
                "163213773102795387028649232479366975830",
                "283579218541017171684689494770732785154",
                "49403815870465363966445380698432578282"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "myisam/myisampack.c"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2020-5398-7b9a3233",
        "source": "https://github.com/mysql/mysql-server/commit/a50cc250ffff75eb1a52f9dfeb90a391e1a04cf9",
        "digest": {
            "line_hashes": [
                "191806062182666600507646994983253615409",
                "301743209239090784792403320182528337718",
                "283579218541017171684689494770732785154",
                "28050264574065629034589924804658801911"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "client/mysqlcheck.c"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2020-5398-89d00177",
        "source": "https://github.com/mysql/mysql-server/commit/a50cc250ffff75eb1a52f9dfeb90a391e1a04cf9",
        "digest": {
            "line_hashes": [
                "332426695089840650221473020143658201782",
                "163213773102795387028649232479366975830",
                "283579218541017171684689494770732785154",
                "301995084952544754799980041252067898096"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "client/mysqladmin.cc"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2020-5398-8fef25ba",
        "source": "https://github.com/mysql/mysql-server/commit/a50cc250ffff75eb1a52f9dfeb90a391e1a04cf9",
        "digest": {
            "line_hashes": [
                "332426695089840650221473020143658201782",
                "163213773102795387028649232479366975830",
                "283579218541017171684689494770732785154",
                "135831442793539143719651860588652735777"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "client/mysqlimport.c"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "id": "CVE-2020-5398-adc4f978",
        "source": "https://github.com/mysql/mysql-server/commit/a50cc250ffff75eb1a52f9dfeb90a391e1a04cf9",
        "digest": {
            "length": 3038.0,
            "function_hash": "35274163327144436881005907227189575888"
        },
        "deprecated": false,
        "target": {
            "file": "netware/mysql_test_run.c",
            "function": "setup"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2020-5398-cc083cf4",
        "source": "https://github.com/mysql/mysql-server/commit/a50cc250ffff75eb1a52f9dfeb90a391e1a04cf9",
        "digest": {
            "line_hashes": [
                "31124030422733726017064343278784896825",
                "309891614808491306136259946086270156839",
                "283579218541017171684689494770732785154",
                "169289322839281234260500212008461171283"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "myisam/myisamchk.c"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2020-5398-ea916cc0",
        "source": "https://github.com/mysql/mysql-server/commit/a50cc250ffff75eb1a52f9dfeb90a391e1a04cf9",
        "digest": {
            "line_hashes": [
                "88122307925743246448843743527906136474",
                "8071850358766640010588713262861304908",
                "283579218541017171684689494770732785154",
                "147075434473015041838501916981257854123"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "target": {
            "file": "client/mysql.cc"
        }
    }
]

Git / github.com/spring-projects/spring-framework

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-framework
Events
Introduced
f4f990b2c900a9b325fd0770d9064a188d073253
Fixed
2d8968708ae59e2c3d1769175ea2b1aa3888d84c