CVE-2015-5211 Files or Directories Accessible to External Parties in org.springframework:spring-core

What is CVE-2015-5211?

CVE-2015-5211 is a critical vulnerability in Debian Debian Linux, published on 25 May 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.

Weakness: CWE-552

Which versions are affected by CVE-2015-5211?

6 open source packages ship an affected version, including org.springframework:spring-core. It affects 2 products.

Products include Debian Debian Linux, Vmware Spring Framework.

How do I fix CVE-2015-5211?

Upgrade org.springframework:spring-core to a fixed version for your release line: 3.2.15, 4.1.8 or 4.2.2.

Is CVE-2015-5211 being exploited?

There is no known exploitation of CVE-2015-5211 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2015-5211, GHSA-pgf9-h69p-pcgf, MGASA-2015-0426, ROOT-APP-MAVEN-CVE-2015-5211, UBUNTU-CVE-2015-5211.