CVE-2015-5211 describes a Reflected File Download (RFD) vulnerability affecting Spring Framework versions 4.2.0-4.2.1, 4.0.0-4.1.7, 3.2.0-3.2.14, and older unsupported versions, impacting Debian and VMware Spring Framework deployments. This critical vulnerability, with a CVSS score of 9.6, allows attackers to craft malicious URLs that force a user's browser to download a batch script rather than render content, potentially leading to arbitrary code execution. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, the high severity and potential for complete compromise warrant attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.2.0CPE matchmatch criteria | cpe:2.3:a:vmware:spring_framework:3.2.0:*:*:*:*:*:*:* | ||
3.2.1CPE matchmatch criteria | cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:* | ||
3.2.2CPE matchmatch criteria | cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:* | ||
3.2.3CPE matchmatch criteria | cpe:2.3:a:vmware:spring_framework:3.2.3:*:*:*:*:*:*:* | ||
3.2.4CPE matchmatch criteria | cpe:2.3:a:vmware:spring_framework:3.2.4:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.8 Bluesky, 0.5 Mastodon, and 1.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.