{"action":"Upgrade org.springframework:spring-webflux to 5.2.3 or later.","affected":[{"fixed":"5.2.3","introduced":"5.2.0"}],"component":"org.springframework:spring-webflux","cve_ids":["CVE-2020-5397"],"ecosystem":"Maven","epss":0.02551,"exploited":false,"fixed_versions":["5.2.3"],"ghsa_id":"GHSA-7pm4-g2qj-j85x","id":"tcs_01M5N8JTRE3C16TT3694W0YBSP","modified_at":"2024-03-15T16:12:40.150978Z","published_at":"2020-01-21T20:59:33Z","references":["https://osv.dev/vulnerability/GHSA-7pm4-g2qj-j85x","https://nvd.nist.gov/vuln/detail/CVE-2020-5397","https://github.com/spring-projects/spring-framework/commit/bc7d01048579430b4b2df668178809b63d3f1929","https://github.com/spring-projects/spring-framework","https://pivotal.io/security/cve-2020-5397","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-7pm4-g2qj-j85x#Maven/org.springframework:spring-webflux","url":"https://osv.dev/vulnerability/GHSA-7pm4-g2qj-j85x"}],"summary":"CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux"}