Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2025-10350

Опубликовано: 12 июн. 2025
Источник: fstec
CVSS3: 6.5
CVSS2: 5.6
EPSS Низкий

Описание

Уязвимость фреймворка Spring Framework связана с непринятием мер по обработке последовательностей CRLF в заголовках HTTP Headers (или "Расщепление ответа HTTP"). Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, провести атаку RFD с помощью использования заголовка "Content-Disposition"

Вендор

Broadcom Inc.

Наименование ПО

Spring Framework

Версия ПО

от 6.2.0 до 6.2.8 (Spring Framework)
от 6.1.0 до 6.1.21 (Spring Framework)
от 6.0.0 до 6.0.29 (Spring Framework)

Тип ПО

Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

-

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 5,6)
Средний уровень опасности (базовая оценка CVSS 3.1 составляет 6,5)

Возможные меры по устранению уязвимости

Использование рекомендаций:
https://spring.io/security/cve-2025-41234

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Ссылки на источники

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 29%
0.00106
Низкий

6.5 Medium

CVSS3

5.6 Medium

CVSS2

Связанные уязвимости

CVSS3: 6.5
ubuntu
6 месяцев назад

Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an application is vulnerable when all the following are true: * The header is prepared with org.springframework.http.ContentDisposition. * The filename is set via ContentDisposition.Builder#filename(String, Charset). * The value for the filename is derived from user-supplied input. * The application does not sanitize the user-supplied input. * The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details). An application is not vulnerable if any of the following is true: * The application does not set a “Content-Disposition” response header. * The header is not prepared with org.springframework.http.C...

CVSS3: 6.5
redhat
6 месяцев назад

Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an application is vulnerable when all the following are true: * The header is prepared with org.springframework.http.ContentDisposition. * The filename is set via ContentDisposition.Builder#filename(String, Charset). * The value for the filename is derived from user-supplied input. * The application does not sanitize the user-supplied input. * The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details). An application is not vulnerable if any of the following is true: * The application does not set a “Content-Disposition” response header. * The header is not prepared with org.springframework.http.C...

CVSS3: 6.5
nvd
6 месяцев назад

Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an application is vulnerable when all the following are true: * The header is prepared with org.springframework.http.ContentDisposition. * The filename is set via ContentDisposition.Builder#filename(String, Charset). * The value for the filename is derived from user-supplied input. * The application does not sanitize the user-supplied input. * The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details). An application is not vulnerable if any of the following is true: * The application does not set a “Content-Disposition” response header. * The header is not prepared with org.sprin

CVSS3: 6.5
debian
6 месяцев назад

Description In Spring Framework, versions 6.0.x as of 6.0.5, versions ...

CVSS3: 6.5
github
6 месяцев назад

Spring Framework vulnerable to a reflected file download (RFD)

EPSS

Процентиль: 29%
0.00106
Низкий

6.5 Medium

CVSS3

5.6 Medium

CVSS2