CVE-2020-5398: Netapp Data Availability Services

High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days.

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Affected products

• Netapp Data Availability Services: affected versions not specified
• Netapp Snapcenter: affected versions not specified
• Oracle Application Testing Suite: version 13.3.0.1 only
• Oracle Communications Billing And Revenue Management Elastic Charging Engine: version 11.3 only; version 12.0 only
• Oracle Communications Cloud Native Core Policy: version 1.5.0 only
• Oracle Communications Diameter Signaling Router: from 8.0.0, up to and including 8.2.2
• Oracle Communications Element Manager: version 8.1.1 only; version 8.2.0 only; version 8.2.1 only
• Oracle Communications Policy Management: version 12.5.0 only
• Oracle Communications Session Report Manager: version 8.1.1 only; version 8.2.0 only; version 8.2.1 only
• Oracle Communications Session Route Manager: version 8.1.1 only; version 8.2.0 only; version 8.2.1 only
• Oracle Enterprise Manager Base Platform: version 13.2.1.0 only
• Oracle Financial Services Regulatory Reporting With Agilereporter: version 8.0.9.2.0 only
• Oracle Flexcube Private Banking: version 12.0.0 only; version 12.1.0 only
• Oracle Healthcare Master Person Index: version 4.0.2 only
• Oracle Insurance Calculation Engine: from 11.0.0, up to and including 11.3.1
• Oracle Insurance Policy Administration j2ee: version 10.2.0 only; version 10.2.4 only; version 11.0.2 only; version 11.1.0 only; version 11.2.0 only; version 11.2.2.0 only
• Oracle Insurance Rules Palette: version 10.2.0 only; version 10.2.4 only; version 11.0.2 only; version 11.1.0 only; version 11.2.0 only
• Oracle MySQL: from 4.0.0, up to and including 4.0.12; from 8.0.0, up to and including 8.0.20
• Oracle Rapid Planning: version 12.1 only; version 12.2 only
• Oracle Retail Assortment Planning: version 15.0 only; version 16.0 only
• Oracle Retail Back Office: version 14.1 only
• Oracle Retail Bulk Data Integration: version 16.0.3.0 only
• Oracle Retail Central Office: version 14.1 only
• Oracle Retail Financial Integration: version 15.0 only; version 16.0 only
• Oracle Retail Integration Bus: version 15.0.3 only; version 16.0.3 only
• and 8 more

Published 2020-01-17. Last modified 2026-10-08.