CVE-2020-5421: Netapp Oncommand Insight
Medium severity, CVSS 6.5. EPSS: 10.7% chance of exploitation in the next 30 days.
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
Affected products
- Netapp Oncommand Insight: affected versions not specified
- Netapp Snap Creator Framework: affected versions not specified
- Netapp Snapcenter: affected versions not specified
- Oracle Commerce Guided Search: version 11.3.2 only
- Oracle Communications Brm: version 11.3.0.9 only; version 12.0.0.3 only
- Oracle Communications Design Studio: version 7.3.4 only; version 7.3.5 only; version 7.4.0 only
- Oracle Communications Session Report Manager: from 8.2.1, up to and including 8.2.2.1
- Oracle Communications Unified Inventory Management: version 7.3.4 only; version 7.3.5 only
- Oracle Endeca Information Discovery Integrator: version 3.2.0 only
- Oracle Enterprise Data Quality: version 12.2.1.3.0 only; version 12.2.1.4.0 only
- Oracle Financial Services Analytical Applications Infrastructure: from 8.0.6, up to and including 8.1.0
- Oracle Flexcube Private Banking: version 12.0.0 only; version 12.1.0 only
- Oracle Fusion Middleware: version 12.2.1.3.0 only; version 12.2.1.4.0 only
- Oracle Goldengate Application Adapters: version 19.1.0.0.0 only
- Oracle Healthcare Master Person Index: version 4.0.2.5 only
- Oracle Hyperion Infrastructure Technology: version 11.1.2.4 only
- Oracle Insurance Policy Administration: from 11.1.0, up to and including 11.3.0; version 10.2 only; version 10.2.4 only; version 11.0.2 only
- Oracle Insurance Rules Palette: from 11.1.0, up to and including 11.3.0; version 10.2.0 only; version 10.2.4 only; version 11.0.2 only
- Oracle MySQL Enterprise Monitor: up to and including 8.0.22; version 8.0.23 only
- Oracle Primavera Gateway: from 16.2.0, up to and including 16.2.11; from 17.12.0, up to and including 17.12.9; from 18.8.0, up to and including 18.8.10; from 19.12.0, up to and including 19.12.10
- Oracle Primavera p6 Enterprise Project Portfolio Management: from 16.1.0, up to and including 16.2.20; from 17.1.0, up to and including 17.12.19; from 18.1.0, up to and including 18.8.21; from 19.12.0, up to and including 19.12.10
- Oracle Retail Assortment Planning: version 16.0.3.0 only
- Oracle Retail Bulk Data Integration: version 16.0.3.0 only
- Oracle Retail Customer Engagement: from 16.0, up to and including 19.0
- Oracle Retail Customer Management And Segmentation Foundation: from 16.0, up to and including 19.0
- and 13 more
Published 2020-09-19. Last modified 2026-10-08.