{
  "@id": "urn:uuid:ce2960a3-ad0c-49f3-a5ff-a24eb366e31b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:50:03.446715+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@4.3.25.RELEASE-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@4.3.25.RELEASE-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-09T19:02:30.715456+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 4.3.25.RELEASE-tuxcare.8 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 describes an RFD (Reflected File Download) protection bypass via jsessionid path parameters. The target version 4.3.25.RELEASE (released August 2019) is NOT affected because it predates the vulnerability introduction by over a year. The vulnerability was introduced in September 2020 (commit 2f75212eb6 between v4.3.28 and v4.3.29) and fixed in October 2020. The target already has t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 describes an RFD (Reflected File Download) protection bypass via jsessionid path parameters. The target version 4.3.25.RELEASE (released August 2019) is NOT affected because it predates the vulnerability introduction by over a year. The vulnerability was introduced in September 2020 (commit 2f75212eb6 between v4.3.28 and v4.3.29) and fixed in October 2020. The target already has t..."
    }
  ]
}