StackRadar

CVE-2020-5398

High

Advisory

Published 21 Jan 2020In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.884
100th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
17
of 17,781 indexed, latest versions
Container images
13
deployed by those charts
Fix available
2 of 2
affected packages

RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

Carried by container images the latest versions of 17 of 17,781 indexed charts deploy, on 13 images.

Affected packageAffected versionsFixed inImages
spring-webmvcmaven5.0.6.RELEASE, 5.0.8.RELEASE, 5.1.3.RELEASE, 5.1.5.RELEASE+4 more5.0.16.RELEASE, 5.1.13.RELEASE, 5.2.3.RELEASE12
spring-webfluxmaven5.2.2.RELEASE5.2.3.RELEASE1
OSV records
GHSA-8wx2-9q48-vm9r

Charts affected

17 by stars
ChartLatestAffected imagesRadar Score
rocketmqgin1.1.01 of 2See more

rocketmq gin 1.1.0

1 of the 2 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
apacherocketmq/rocketmq-dashboard:1.0.024799aff6cf8
spring-webmvc@5.2.2.RELEASE
5.2.3.RELEASE

Open the chart page →

9,154
omada-controllergeek-cookbookVerified publisher4.4.21 of 1See more

omada-controller geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
mbentley/omada-controller:4.3f4e682274bed
spring-webmvc@5.1.6.RELEASE
5.1.13.RELEASE

Open the chart page →

11,553
omada-controllerandrelote-k8sVerified publisher4.5.01 of 1See more

omada-controller andrelote-k8s 4.5.0

1 of the 1 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
mbentley/omada-controller:4.3f4e682274bed
spring-webmvc@5.1.6.RELEASE
5.1.13.RELEASE

Open the chart page →

11,553
pulsarcnieg1.0.81 of 2See more

pulsar cnieg 1.0.8

1 of the 2 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
spring-webmvc@5.0.6.RELEASE
5.0.16.RELEASE

Open the chart page →

16,860
shenyuerdeng2.4.212 of 2See more

shenyu erdeng 2.4.21

2 of the 2 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
spring-webmvc@5.2.2.RELEASE
5.2.3.RELEASE
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
spring-webflux@5.2.2.RELEASE
5.2.3.RELEASE

Open the chart page →

12,513
scorpio-brokerfiware0.3.31 of 10See more

scorpio-broker fiware 0.3.3

1 of the 10 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
scorpiobroker/scorpio:config-server_1.1.0c46c1517e523
spring-webmvc@5.1.10.RELEASE
5.1.13.RELEASE

Open the chart page →

55,600
scorpiobrokerfiware0.1.21 of 10See more

scorpiobroker fiware 0.1.2

1 of the 10 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
scorpiobroker/scorpio:config-server_1.1.0c46c1517e523
spring-webmvc@5.1.10.RELEASE
5.1.13.RELEASE

Open the chart page →

55,600
springboothelmcharts1.0.01 of 1See more

springboot helmcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
kimb88/hello-world-spring-boot:latest0639155241cb
spring-webmvc@5.0.8.RELEASE
5.0.16.RELEASE

Open the chart page →

6,451
kanbanapp-demokanbanapp-demo0.3.01 of 3See more

kanbanapp-demo kanbanapp-demo 0.3.0

1 of the 3 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
sdandey/dandey-apps:kanban-board-kanban-appbef0f599737b
spring-webmvc@5.1.8.RELEASE
5.1.13.RELEASE

Open the chart page →

7,498
ladeitladeit0.4.01 of 2See more

ladeit ladeit 0.4.0

1 of the 2 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
ladeit/ladeit:latest962b665ffe82
spring-webmvc@5.1.3.RELEASE
5.1.13.RELEASE

Open the chart page →

26,356
pulsarv2milvus-helm2.7.81 of 4See more

pulsarv2 milvus-helm 2.7.8

1 of the 4 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
spring-webmvc@5.0.6.RELEASE
5.0.16.RELEASE

Open the chart page →

15,855
ves-agentopencord1.0.21 of 1See more

ves-agent opencord 1.0.2

1 of the 1 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
opencord/ves-agent:1.0.04187e2a8c918
spring-webmvc@5.0.6.RELEASE
5.0.16.RELEASE

Open the chart page →

6,350
issuegenopsmxVerified publisher1.0.21 of 1See more

issuegen opsmx 1.0.2

1 of the 1 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
opsmx11/issuegen:v2.1.05c50ca123d88
spring-webmvc@5.1.10.RELEASE
5.1.13.RELEASE

Open the chart page →

26,339
helloworldpauls-helm-charts2.0.01 of 1See more

helloworld pauls-helm-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
paulczar/spring-helloworld:latestc7140cecd5f7
spring-webmvc@5.1.5.RELEASE
5.1.13.RELEASE

Open the chart page →

5,596
shenyushenyu-helm-chart-test2.4.272 of 2See more

shenyu shenyu-helm-chart-test 2.4.27

2 of the 2 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
spring-webmvc@5.2.2.RELEASE
5.2.3.RELEASE
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
spring-webflux@5.2.2.RELEASE
5.2.3.RELEASE

Open the chart page →

12,513
umsappstacksimplifyVerified publisher1.0.01 of 3See more

umsapp stacksimplify 1.0.0

1 of the 3 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
ghcr.io/stacksimplify/kube-usermgmt-webapp:1.0.0-mysqldb41b45003c6b6
spring-webmvc@5.1.8.RELEASE
5.1.13.RELEASE

Open the chart page →

6,101
shenyutest-helm2.4.212 of 2See more

shenyu test-helm 2.4.21

2 of the 2 container images this version deploys carry CVE-2020-5398.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
spring-webmvc@5.2.2.RELEASE
5.2.3.RELEASE
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
spring-webflux@5.2.2.RELEASE
5.2.3.RELEASE

Open the chart page →

12,513

Container images carrying it

13 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
apache/shenyu-admin:2.4.2e8b7c4ddd069
spring-webmvc@5.2.2.RELEASE
5.2.3.RELEASE
3
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
spring-webflux@5.2.2.RELEASE
5.2.3.RELEASE
3
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
spring-webmvc@5.0.6.RELEASE
5.0.16.RELEASE
2
mbentley/omada-controller:4.3f4e682274bed
spring-webmvc@5.1.6.RELEASE
5.1.13.RELEASE
2
scorpiobroker/scorpio:config-server_1.1.0c46c1517e523
spring-webmvc@5.1.10.RELEASE
5.1.13.RELEASE
2
apacherocketmq/rocketmq-dashboard:1.0.024799aff6cf8
spring-webmvc@5.2.2.RELEASE
5.2.3.RELEASE
1
kimb88/hello-world-spring-boot:latest0639155241cb
spring-webmvc@5.0.8.RELEASE
5.0.16.RELEASE
1
ladeit/ladeit:latest962b665ffe82
spring-webmvc@5.1.3.RELEASE
5.1.13.RELEASE
1
opencord/ves-agent:1.0.04187e2a8c918
spring-webmvc@5.0.6.RELEASE
5.0.16.RELEASE
1
opsmx11/issuegen:v2.1.05c50ca123d88
spring-webmvc@5.1.10.RELEASE
5.1.13.RELEASE
1
paulczar/spring-helloworld:latestc7140cecd5f7
spring-webmvc@5.1.5.RELEASE
5.1.13.RELEASE
1
sdandey/dandey-apps:kanban-board-kanban-appbef0f599737b
spring-webmvc@5.1.8.RELEASE
5.1.13.RELEASE
1
ghcr.io/stacksimplify/kube-usermgmt-webapp:1.0.0-mysqldb41b45003c6b6
spring-webmvc@5.1.8.RELEASE
5.1.13.RELEASE
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.