Investigate vulnerability: Download of Code Without Integrity Check in org.springframework/spring-web
Description:
In Spring Framework, an application is vulnerable to a reflected file download (RFD) attack when it sets a Content-Disposition header in the response where the filename attribute is derived from user supplied input.
- Severity: high
- Confidence: unknown
- Location: pom.xml
Solution:
Upgrade to versions 5.0.16.RELEASE, 5.1.13.RELEASE, 5.2.3.RELEASE or above.