Description
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
References (3)
Core 3
Core References
Exploit, Technical Description x_refsource_misc
https://www.trustwave.com/Resources/SpiderLabs-Blog/Reflected-File-Download---A-New-Web-Attack-Vector/
Vendor Advisory x_refsource_confirm
https://pivotal.io/security/cve-2015-5211
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
Scores
CVSS v3
9.6
EPSS
0.0192
EPSS Percentile
83.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Details
CWE
CWE-552
Status
published
Products (37)
debian/debian_linux
8.0
org.springframework/spring-core
4.2.0 - 4.2.2Maven
vmware/spring_framework
3.2.0
vmware/spring_framework
3.2.1
vmware/spring_framework
3.2.2
vmware/spring_framework
3.2.3
vmware/spring_framework
3.2.4
vmware/spring_framework
3.2.5
vmware/spring_framework
3.2.6
vmware/spring_framework
3.2.7
... and 27 more
Published
May 25, 2017
Tracked Since
Feb 18, 2026