CVE-2020-5397

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.

• CWE-352
• CWE-352

• https://pivotal.io/security/cve-2020-5397Exploit, Vendor Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://pivotal.io/security/cve-2020-5397Exploit, Vendor Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Published

Jan 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5390PySAML2 before 5.0.0 does not check that the signature in a …7.5
• CVE-2020-5391Cross-site request forgery (CSRF) vulnerabilities exist in t…8.8
• CVE-2020-5392A stored cross-site scripting (XSS) vulnerability exists in …6.1
• CVE-2020-5393In Appspace On-Prem through 7.1.3, an adversary can steal a …6.1
• CVE-2020-5395FontForge 20190801 has a use-after-free in SFD_GetFontMetaDa…8.8
• CVE-2020-5396VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9…8.8
• CVE-2020-5398In Spring Framework, versions 5.2.x prior to 5.2.3, versions…7.5
• CVE-2020-5399Cloud Foundry CredHub, versions prior to 2.5.10, connects to…7.4
• CVE-2020-5400Cloud Foundry Cloud Controller (CAPI), versions prior to 1.9…6.5
• CVE-2020-5401Cloud Foundry Routing Release, versions prior to 0.197.0, co…5.3
• CVE-2020-5402In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vuln…8.8
• CVE-2020-5403Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is expos…7.5