[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiJtc8Rstgcc9MxGmcV7XXJDsEjBg95l0tI8wfweZ0ow":3,"g5a-risk:CVE-2020-5407":131},{"success":4,"data":5,"meta":129},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":40,"epssPercentile":26,"epssTimeSeries":41,"severity":42,"affectedProducts":43,"affectedProductsCount":49,"references":50,"referencesCount":76,"weaknesses":77,"weaknessesCount":49,"isActivelyExploited":86,"cisaInfo":26,"otxData":26,"relatedBlogPosts":87,"seoMetadata":88,"configurations":113,"relatedVendorCves":127,"notableEvents":128},"CVE-2020-5407","What is CVE-2020-5407?","Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.","Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using...","2020-05-13T17:15:11.967","2023-11-07T03:23:46.787",8.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":29,"CVSSMetricV40":26},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":22,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":25,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,2.8,5.9,[30],{"Source":17,"Type":18,"CVSSData":31,"BaseSeverity":37,"ExploitabilityScore":38,"ImpactScore":39,"ACInsufInfo":26,"ObtainAllPrivilege":26,"ObtainUserPrivilege":26,"ObtainOtherPrivilege":26,"UserInteractionRequired":26},{"Version":32,"VectorString":33,"AccessVector":21,"AccessComplexity":22,"Authentication":34,"ConfidentialityImpact":35,"IntegrityImpact":35,"AvailabilityImpact":35,"BaseScore":36,"BaseSeverity":26,"Exploitability":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"CollateralDamagePotential":26,"TargetDistribution":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"EnvironmentalScore":26},"2.0","AV:N\u002FAC:L\u002FAu:S\u002FC:P\u002FI:P\u002FA:P","SINGLE","PARTIAL",6.5,"MEDIUM",8,6.4,0.01199,[40,40,40,40,40,40,40],"High",[44],{"vendor":45,"product":46,"version":47,"criteria":48,"vulnerable":4},"pivotal_software","spring_security","*","cpe:2.3:a:pivotal_software:spring_security:*:*:*:*:*:*:*:*",1,[51,55,58,61,66,70,73],{"url":52,"source":53,"tags":54},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fr73af928cf64bebf78b7fa4bc56a5253273ec7829f5f5827f64c72fc7%40%3Cissues.servicemix.apache.org%3E","Apache",[],{"url":56,"source":53,"tags":57},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Fra19a4e7236877fe12bfb52db07b27ad72d9e7a9f5e27bba7e928e18a%40%3Cdev.geode.apache.org%3E",[],{"url":59,"source":53,"tags":60},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frd99601fbca514f214f88f9e53fd5be3cfbff05b350c994b4ec2e184c%40%3Cdev.geode.apache.org%3E",[],{"url":62,"source":63,"tags":64},"https:\u002F\u002Ftanzu.vmware.com\u002Fsecurity\u002Fcve-2020-5407","Vmware",[65],"Vendor Advisory",{"url":67,"source":68,"tags":69},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002FcpuApr2021.html","Oracle",[],{"url":71,"source":68,"tags":72},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002Fcpujan2021.html",[],{"url":74,"source":68,"tags":75},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002Fcpuoct2020.html",[],7,[78],{"id":79,"name":80,"description":81,"extendedDescription":82,"status":83,"abstraction":84,"structure":85},"CWE-347","Improper Verification of Cryptographic Signature","The product does not verify, or incorrectly verifies, the cryptographic signature for data.","","Draft","Base","Simple",false,[],{"title":89,"metaDescription":90,"keywords":91,"canonicalUrl":92,"structuredData":93},"What is CVE-2020-5407? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2020-5407, a high severity cyber security vulnerability from 2020. Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prio...","CVE-2020-5407, CVE-2020-5407 vulnerability, CVE-2020-5407 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2020, CVSS score, exploit, patch, remediation, pivotal_software security, spring_security vulnerability","\u002Fwhat-is\u002Fcve-2020-5407",{"@context":94,"@type":95,"headline":89,"description":90,"datePublished":10,"dateModified":11,"author":96,"publisher":100,"about":104,"mainEntityOfPage":108,"articleSection":111,"keywords":112},"https:\u002F\u002Fschema.org","TechArticle",{"@type":97,"name":98,"url":99},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":97,"name":98,"url":99,"logo":101},{"@type":102,"url":103},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":105,"name":6,"description":106,"additionalType":107},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":109,"@id":110},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2020-5407","Cybersecurity","CVE-2020-5407, CVE-2020-5407 vulnerability, CVE-2020-5407 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[114],{"Operator":26,"Negate":26,"Nodes":115},[116],{"Operator":117,"Negate":26,"CPEMatch":118},"OR",[119,123],{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":120,"VersionStartExcluding":26,"VersionStartIncluding":121,"VersionEndExcluding":122,"VersionEndIncluding":26},"79167645-DB8D-4B2E-8F41-19BF2B292516","5.2.0","5.2.4",{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":124,"VersionStartExcluding":26,"VersionStartIncluding":125,"VersionEndExcluding":126,"VersionEndIncluding":26},"FC9C28BC-B248-4CDB-9BA9-C784D74E32A5","5.3.0","5.3.2",[],[],{"lastModified":11,"cacheTime":130,"version":32},1792281333412,{"score":132,"band":133,"action":134,"scoredAt":135},47,"Medium","Plan remediation","2026-10-16T06:48:37.059973+00:00"]