RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

Affected packages

• org.springframework:spring-webflux— 5.2.0.RELEASE → 5.2.3.RELEASE
• org.springframework:spring-webmvc— 5.2.0.RELEASE → 5.2.3.RELEASE

Exploit signal

Known exploited (CISA KEV)

No

EPSS score

—

EPSS percentile

—

EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.