[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f548erJvafKYjiMJaPphvb1oHWlp1tNnOfNM8ifuiqfM":3,"g5a-risk:CVE-2020-5408":142},{"success":4,"data":5,"meta":140},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":40,"epssPercentile":27,"epssTimeSeries":41,"severity":42,"affectedProducts":43,"affectedProductsCount":52,"references":53,"referencesCount":37,"weaknesses":69,"weaknessesCount":52,"isActivelyExploited":85,"cisaInfo":27,"otxData":27,"relatedBlogPosts":86,"seoMetadata":87,"configurations":112,"relatedVendorCves":138,"notableEvents":139},"CVE-2020-5408","What is CVE-2020-5408?","Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.","Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null ...","2020-05-14T18:15:12.25","2021-06-14T18:15:32.44",6.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":27,"CVSSMetricV2":30,"CVSSMetricV40":27},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":28,"ImpactScore":29},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":22,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":23,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH","MEDIUM",null,2.8,3.6,[31],{"Source":17,"Type":18,"CVSSData":32,"BaseSeverity":26,"ExploitabilityScore":38,"ImpactScore":39,"ACInsufInfo":27,"ObtainAllPrivilege":27,"ObtainUserPrivilege":27,"ObtainOtherPrivilege":27,"UserInteractionRequired":27},{"Version":33,"VectorString":34,"AccessVector":21,"AccessComplexity":22,"Authentication":35,"ConfidentialityImpact":36,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":37,"BaseSeverity":27,"Exploitability":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"CollateralDamagePotential":27,"TargetDistribution":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"EnvironmentalScore":27},"2.0","AV:N\u002FAC:L\u002FAu:S\u002FC:P\u002FI:N\u002FA:N","SINGLE","PARTIAL",4,8,2.9,0.01594,[40,40,40,40,40,40,40],"Medium",[44,49],{"vendor":45,"product":46,"version":47,"criteria":48,"vulnerable":4},"pivotal_software","spring_security","*","cpe:2.3:a:pivotal_software:spring_security:*:*:*:*:*:*:*:*",{"vendor":50,"product":46,"version":47,"criteria":51,"vulnerable":4},"vmware","cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*",2,[54,59,63,66],{"url":55,"source":56,"tags":57},"https:\u002F\u002Ftanzu.vmware.com\u002Fsecurity\u002Fcve-2020-5408","Vmware",[58],"Vendor Advisory",{"url":60,"source":61,"tags":62},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002FcpuApr2021.html","Oracle",[],{"url":64,"source":61,"tags":65},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002Fcpujan2021.html",[],{"url":67,"source":61,"tags":68},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002Fcpuoct2020.html",[],[70,78],{"id":71,"name":72,"description":73,"extendedDescription":74,"status":75,"abstraction":76,"structure":77},"CWE-329","Generation of Predictable IV with CBC Mode","The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.","CBC mode eliminates a weakness of Electronic Code\n\t   Book (ECB) mode by allowing identical plaintext blocks to\n\t   be encrypted to different ciphertext blocks. This is\n\t   possible by the XOR-ing of an IV with the initial plaintext\n\t   block so that every plaintext block in the chain is XOR'd\n\t   with a different value before encryption. If IVs are\n\t   reused, then identical plaintexts would be encrypted to\n\t   identical ciphertexts. However, even if IVs are not\n\t   identical but are predictable, then they still break the\n\t   security of CBC mode against Chosen Plaintext Attacks\n\t   (CPA).","Draft","Variant","Simple",{"id":79,"name":80,"description":81,"extendedDescription":82,"status":83,"abstraction":84,"structure":77},"CWE-330","Use of Insufficiently Random Values","The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.","When product generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information.","Stable","Class",false,[],{"title":88,"metaDescription":89,"keywords":90,"canonicalUrl":91,"structuredData":92},"What is CVE-2020-5408? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2020-5408, a medium severity cyber security vulnerability from 2020. Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior...","CVE-2020-5408, CVE-2020-5408 vulnerability, CVE-2020-5408 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2020, CVSS score, exploit, patch, remediation, pivotal_software security, vmware security, spring_security vulnerability","\u002Fwhat-is\u002Fcve-2020-5408",{"@context":93,"@type":94,"headline":88,"description":89,"datePublished":10,"dateModified":11,"author":95,"publisher":99,"about":103,"mainEntityOfPage":107,"articleSection":110,"keywords":111},"https:\u002F\u002Fschema.org","TechArticle",{"@type":96,"name":97,"url":98},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":96,"name":97,"url":98,"logo":100},{"@type":101,"url":102},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":104,"name":6,"description":105,"additionalType":106},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":108,"@id":109},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2020-5408","Cybersecurity","CVE-2020-5408, CVE-2020-5408 vulnerability, CVE-2020-5408 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[113],{"Operator":27,"Negate":27,"Nodes":114},[115],{"Operator":116,"Negate":27,"CPEMatch":117},"OR",[118,122,126,130,134],{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":119,"VersionStartExcluding":27,"VersionStartIncluding":120,"VersionEndExcluding":121,"VersionEndIncluding":27},"79167645-DB8D-4B2E-8F41-19BF2B292516","5.2.0","5.2.4",{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":123,"VersionStartExcluding":27,"VersionStartIncluding":124,"VersionEndExcluding":125,"VersionEndIncluding":27},"FC9C28BC-B248-4CDB-9BA9-C784D74E32A5","5.3.0","5.3.2",{"Vulnerable":4,"Criteria":51,"MatchCriteriaID":127,"VersionStartExcluding":27,"VersionStartIncluding":128,"VersionEndExcluding":129,"VersionEndIncluding":27},"7EE7A948-18BC-4F0F-B30C-F4823BCB3D17","4.2.0","4.2.16",{"Vulnerable":4,"Criteria":51,"MatchCriteriaID":131,"VersionStartExcluding":27,"VersionStartIncluding":132,"VersionEndExcluding":133,"VersionEndIncluding":27},"D20A6A01-B3C6-4B9D-B1E2-7EC2CF1DD7B8","5.0.0","5.0.16",{"Vulnerable":4,"Criteria":51,"MatchCriteriaID":135,"VersionStartExcluding":27,"VersionStartIncluding":136,"VersionEndExcluding":137,"VersionEndIncluding":27},"B28A37AA-FE75-42B2-9C0F-9CE60933F4B4","5.1.0","5.1.10",[],[],{"lastModified":11,"cacheTime":141,"version":33},1792370585040,{"score":143,"band":144,"action":145,"scoredAt":146},32,"Low","Monitor","2026-10-16T06:48:37.079647+00:00"]