CVE-2015-5211
Severity Score
9.6
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
En algunas situaciones, el Framework Spring versiones 4.2.0 hasta 4.2.1, versiones 4.0.0 hasta 4.1.7, versiones 3.2.0 hasta 3.2.14 y versiones anteriores no compatibles, son vulnerables a un ataque de tipo Reflected File Download (RFD). El ataque involucra a un usuario malicioso que diseña una URL con una extensión de script por lotes lo que resulta en la respuesta siendo descargada en lugar de renderizada y también incluye alguna entrada reflejada en la respuesta.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2015-07-01 CVE Reserved
- 2017-05-25 CVE Published
- 2023-07-08 EPSS Updated
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-552: Files or Directories Accessible to External Parties
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://www.trustwave.com/Resources/SpiderLabs-Blog/Reflected-File-Download---A-New-Web-Attack-Vector | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://pivotal.io/security/cve-2015-5211 | 2022-06-05 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.0 Search vendor "Vmware" for product "Spring Framework" and version "3.2.0" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.1 Search vendor "Vmware" for product "Spring Framework" and version "3.2.1" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.2 Search vendor "Vmware" for product "Spring Framework" and version "3.2.2" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.3 Search vendor "Vmware" for product "Spring Framework" and version "3.2.3" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.4 Search vendor "Vmware" for product "Spring Framework" and version "3.2.4" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.5 Search vendor "Vmware" for product "Spring Framework" and version "3.2.5" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.6 Search vendor "Vmware" for product "Spring Framework" and version "3.2.6" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.7 Search vendor "Vmware" for product "Spring Framework" and version "3.2.7" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.8 Search vendor "Vmware" for product "Spring Framework" and version "3.2.8" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.9 Search vendor "Vmware" for product "Spring Framework" and version "3.2.9" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.10 Search vendor "Vmware" for product "Spring Framework" and version "3.2.10" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.11 Search vendor "Vmware" for product "Spring Framework" and version "3.2.11" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.12 Search vendor "Vmware" for product "Spring Framework" and version "3.2.12" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.13 Search vendor "Vmware" for product "Spring Framework" and version "3.2.13" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 3.2.14 Search vendor "Vmware" for product "Spring Framework" and version "3.2.14" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.0.0 Search vendor "Vmware" for product "Spring Framework" and version "4.0.0" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.0.1 Search vendor "Vmware" for product "Spring Framework" and version "4.0.1" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.0.2 Search vendor "Vmware" for product "Spring Framework" and version "4.0.2" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.0.3 Search vendor "Vmware" for product "Spring Framework" and version "4.0.3" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.0.4 Search vendor "Vmware" for product "Spring Framework" and version "4.0.4" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.0.5 Search vendor "Vmware" for product "Spring Framework" and version "4.0.5" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.0.6 Search vendor "Vmware" for product "Spring Framework" and version "4.0.6" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.0.7 Search vendor "Vmware" for product "Spring Framework" and version "4.0.7" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.0.8 Search vendor "Vmware" for product "Spring Framework" and version "4.0.8" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.0.9 Search vendor "Vmware" for product "Spring Framework" and version "4.0.9" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.1.0 Search vendor "Vmware" for product "Spring Framework" and version "4.1.0" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.1.1 Search vendor "Vmware" for product "Spring Framework" and version "4.1.1" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.1.2 Search vendor "Vmware" for product "Spring Framework" and version "4.1.2" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.1.3 Search vendor "Vmware" for product "Spring Framework" and version "4.1.3" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.1.4 Search vendor "Vmware" for product "Spring Framework" and version "4.1.4" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.1.5 Search vendor "Vmware" for product "Spring Framework" and version "4.1.5" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.1.6 Search vendor "Vmware" for product "Spring Framework" and version "4.1.6" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.1.7 Search vendor "Vmware" for product "Spring Framework" and version "4.1.7" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.2.0 Search vendor "Vmware" for product "Spring Framework" and version "4.2.0" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Spring Framework Search vendor "Vmware" for product "Spring Framework" | 4.2.1 Search vendor "Vmware" for product "Spring Framework" and version "4.2.1" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||