CVE-2020-5408: Pivotal Software Spring Security

Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.

Affected products

• Pivotal Software Spring Security: from 5.2.0, before 5.2.4 (fixed in 5.2.4); from 5.3.0, before 5.3.2 (fixed in 5.3.2)
• VMware Spring Security: from 4.2.0, before 4.2.16 (fixed in 4.2.16); from 5.0.0, before 5.0.16 (fixed in 5.0.16); from 5.1.0, before 5.1.10 (fixed in 5.1.10)

Published 2020-05-14. Last modified 2026-06-17.