CVE:CVE-2020-5397
CNNVD:CNNVD-202001-841
Pivotal Software Spring Framework是美国Pivotal Software公司的一套开源的Java、JavaEE应用程序框架。该框架可帮助开发人员构建高质量的应用。
Pivotal Software Spring Framework 5.2.3之前的5.2.x版本中存在跨站请求伪造漏洞。该漏洞源于WEB应用未充分验证请求是否来自可信用户。攻击者可利用该漏洞通过受影响客户端向服务器发送非预期的请求。
solution:Upgrade vmware spring_framework to a higher version than 5.2.3,and avoid the version [5.2.0,5.2.3); Upgrade oracle application_testing_suite to a higher version than 13.3.0.1,and avoid the version 13.3.0.1; Upgrade oracle communications_brm_-_elastic_charging_engine to a higher version than 11.3,12.0,and avoid the version 11.3,12.0; Upgrade oracle communications_diameter_signaling_router to a higher version than 8.2.2,and avoid the version [8.0.0,8.2.2]; Upgrade oracle communications_element_manager to a higher version than 8.1.1,8.2.0,8.2.1,and avoid the version 8.1.1,8.2.0,8.2.1; Upgrade oracle communications_policy_management to a higher version than 12.5.0,and avoid the version 12.5.0; Upgrade oracle communications_session_route_manager to a higher version than 8.1.1,8.2.0,8.2.1,and avoid the version 8.1.1,8.2.0,8.2.1; Upgrade oracle enterprise_manager_base_platform to a higher version than 13.2.1.0,and avoid the version 13.2.1.0; Upgrade oracle financial_services_regulatory_reporting_with_agilereporter to a higher version than 8.0.9.2.0,and avoid the version 8.0.9.2.0; Upgrade oracle flexcube_private_banking to a higher version than 12.0.0,12.1.0,and avoid the version 12.0.0,12.1.0; Upgrade oracle healthcare_master_person_index to a higher version than 4.0.2,and avoid the version 4.0.2; Upgrade oracle insurance_calculation_engine to a higher version than 11.3.1,and avoid the version [11.0.0,11.3.1]; Upgrade oracle insurance_policy_administration_j2ee to a higher version than 10.2.0,10.2.4,11.0.2,11.1.0,11.2.0,and avoid the version 10.2.0,10.2.4,11.0.2,11.1.0,11.2.0; Upgrade oracle insurance_rules_palette to a higher version than 10.2.0,10.2.4,11.0.2,11.1.0,11.2.0,and avoid the version 10.2.0,10.2.4,11.0.2,11.1.0,11.2.0; Upgrade oracle mysql_enterprise_monitor to a higher version than 4.0.12,8.0.20,and avoid the version [4.0.0,4.0.12],[8.0.0,8.0.20]; Upgrade oracle rapid_planning to a higher version than 12.1,12.2,and avoid the version 12.1,12.2; Upgrade oracle retail_assortment_planning to a higher version than 15.0,16.0,and avoid the version 15.0,16.0; Upgrade oracle retail_back_office to a higher version than 14.1,and avoid the version 14.1; Upgrade oracle retail_central_office to a higher version than 14.1,and avoid the version 14.1; Upgrade oracle retail_financial_integration to a higher version than 15.0,16.0,and avoid the version 15.0,16.0; Upgrade oracle retail_integration_bus to a higher version than 15.0.3,16.0.3,and avoid the version 15.0.3,16.0.3; Upgrade oracle retail_order_broker to a higher version than 15.0,16.0,and avoid the version 15.0,16.0; Upgrade oracle retail_point-of-service to a higher version than 14.1,and avoid the version 14.1; Upgrade oracle retail_predictive_application_server to a higher version than 14.0.3,14.1.3,15.0.3.0,16.0.3.0,and avoid the version 14.0.3,14.1.3,15.0.3.0,16.0.3.0; Upgrade oracle retail_returns_management to a higher version than 14.1,and avoid the version 14.1; Upgrade oracle retail_service_backbone to a higher version than 15.0,16.0,and avoid the version 15.0,16.0; Upgrade oracle weblogic_server to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0