Medium · published September 19, 2020
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
| Product | Versions | Fixed in |
|---|---|---|
| vmware/spring_framework | < 4.3.29 | 4.3.29 |
| vmware/spring_framework | ≥ 5.0.0, < 5.0.19 | 5.0.19 |
| vmware/spring_framework | ≥ 5.1.0, < 5.1.18 | 5.1.18 |
| vmware/spring_framework | ≥ 5.2.0, < 5.2.9 | 5.2.9 |
| oracle/primavera_gateway | ≥ 16.2.0, ≤ 16.2.11 | — |
| oracle/primavera_gateway | ≥ 17.12.0, ≤ 17.12.9 | — |
| oracle/primavera_gateway | ≥ 18.8.0, ≤ 18.8.10 | — |
| oracle/primavera_gateway | ≥ 19.12.0, ≤ 19.12.10 | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | ≥ 16.1.0, ≤ 16.2.20 | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | ≥ 17.1.0, ≤ 17.12.19 | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | ≥ 18.1.0, ≤ 18.8.21 | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | ≥ 19.12.0, ≤ 19.12.10 | — |
| oracle/retail_assortment_planning | all versions | — |
| oracle/retail_bulk_data_integration | all versions | — |
| oracle/retail_customer_engagement | ≥ 16.0, ≤ 19.0 | — |
| oracle/retail_customer_management_and_segmentation_foundation | ≥ 16.0, ≤ 19.0 | — |
| oracle/retail_financial_integration | all versions | — |
| oracle/retail_financial_integration | all versions | — |
| oracle/retail_financial_integration | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_integration_bus | all versions | — |
| oracle/retail_invoice_matching | all versions | — |
| oracle/retail_invoice_matching | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_predictive_application_server | all versions | — |
| oracle/retail_returns_management | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_service_backbone | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/storagetek_acsls | all versions | — |
| oracle/storagetek_tape_analytics_sw_tool | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/commerce_guided_search | all versions | — |
| oracle/communications_brm | all versions | — |
| oracle/communications_brm | all versions | — |
| oracle/communications_design_studio | all versions | — |
| oracle/communications_design_studio | all versions | — |
| oracle/communications_design_studio | all versions | — |
| oracle/communications_session_report_manager | ≥ 8.2.1, ≤ 8.2.2.1 | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/endeca_information_discovery_integrator | all versions | — |
| oracle/enterprise_data_quality | all versions | — |
| oracle/enterprise_data_quality | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 8.0.6, ≤ 8.1.0 | — |
| oracle/flexcube_private_banking | all versions | — |
| oracle/flexcube_private_banking | all versions | — |
| oracle/fusion_middleware | all versions | — |
| oracle/fusion_middleware | all versions | — |
| oracle/goldengate_application_adapters | all versions | — |
| oracle/healthcare_master_person_index | all versions | — |
| oracle/hyperion_infrastructure_technology | all versions | — |
| oracle/insurance_policy_administration | ≥ 11.1.0, ≤ 11.3.0 | — |
| oracle/insurance_policy_administration | all versions | — |
| oracle/insurance_policy_administration | all versions | — |
| oracle/insurance_policy_administration | all versions | — |
| oracle/insurance_rules_palette | ≥ 11.1.0, ≤ 11.3.0 | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/mysql_enterprise_monitor | ≤ 8.0.22 | — |
| oracle/mysql_enterprise_monitor | all versions | — |
| netapp/oncommand_insight | all versions | — |
| netapp/snap_creator_framework | all versions | — |
| netapp/snapcenter | all versions | — |