Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hedq-eav6-4fee
Vulnerability ID VCID-hedq-eav6-4fee
Aliases CVE-2020-5408
GHSA-2ppp-9496-p23q
Summary Insufficient Entropy in Spring Security Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-329 Generation of Predictable IV with CBC Mode
CWE-330 Use of Insufficiently Random Values
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00411 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
epss 0.00468 https://api.first.org/data/v1/epss?cve=CVE-2020-5408
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-2ppp-9496-p23q
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2020-5408
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2020-5408
cvssv3.1 6.5 https://tanzu.vmware.com/security/cve-2020-5408
generic_textual MODERATE https://tanzu.vmware.com/security/cve-2020-5408
cvssv3.1 6.5 https://www.oracle.com/security-alerts/cpuApr2021.html
generic_textual MODERATE https://www.oracle.com/security-alerts/cpuApr2021.html
cvssv3.1 6.5 https://www.oracle.com/security-alerts/cpujan2021.html
generic_textual MODERATE https://www.oracle.com/security-alerts/cpujan2021.html
cvssv3.1 6.5 https://www.oracle.com/security-alerts/cpuoct2020.html
generic_textual MODERATE https://www.oracle.com/security-alerts/cpuoct2020.html
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2020-5408
https://nvd.nist.gov/vuln/detail/CVE-2020-5408
https://tanzu.vmware.com/security/cve-2020-5408
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html
GHSA-2ppp-9496-p23q https://github.com/advisories/GHSA-2ppp-9496-p23q
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-5408
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://tanzu.vmware.com/security/cve-2020-5408
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://www.oracle.com/security-alerts/cpuApr2021.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://www.oracle.com/security-alerts/cpujan2021.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://www.oracle.com/security-alerts/cpuoct2020.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.61411
EPSS Score 0.00411
Published At April 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:00:30.258910+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-2ppp-9496-p23q/GHSA-2ppp-9496-p23q.json 38.0.0