UBUNTU-CVE-2015-5211

Dashboard / Vulnerabilities / UBUNTU-CVE-2015-5211

UBUNTU-CVE-2015-5211

Summary:

Details: Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.

References: https://ubuntu.com/security/CVE-2015-5211, https://jira.spring.io/browse/SPR-13548, https://github.com/spring-projects/spring-framework/commit/2bd1da, https://github.com/spring-projects/spring-framework/commit/a95c3d, https://github.com/spring-projects/spring-framework/commit/03f547, https://pivotal.io/security/cve-2015-5211, https://www.cve.org/CVERecord?id=CVE-2015-5211, https://ubuntu.com/security/notices/USN-4774-1