Old spring-framework not more recognized as vulnerable

### Current Behavior:

We have an old project that uses Spring Framework at version 3.2.18.RELEASE. On Dependency Track v.3.8.0 we got these vulnerabilities:

CVE-2018-1270
CVE-2018-1272
CVE-2016-5007
CVE-2020-5421
CVE-2018-1271

With 4.2.1 Spring Framework is not more recognized as vulnerable. Checking on NVD it seems that 3.2.18.RELEASE should be vulnerable to the same vulnerabilities identified by 3.8.0

### Steps to Reproduce:

Load a BOM with an old version of spring (eg. 3.2.18.RELEASE)

### Expected Behavior:

Old Spring artifacts should be recognized vulnerable for some vulnerabilities (eg. CVE-2018-1270)

### Environment:

- Dependency-Track Version: 4.2.1
- Distribution: Docker
- BOM Format & Version: Cyclonedx XML version 1.2
- Database Server: PostgreSQL

### Additional Details:

We use both internal and oss index analyzer.
This is the list of spring artifacts:
pkg:maven/org.springframework/spring-core@3.2.18.RELEASE?type=jar
pkg:maven/org.springframework/spring-jms@3.2.18.RELEASE?type=jar
pkg:maven/org.springframework/spring-expression@3.2.18.RELEASE?type=jar
pkg:maven/org.springframework/spring-beans@3.2.18.RELEASE?type=jar
pkg:maven/org.springframework/spring-aop@3.2.18.RELEASE?type=jar
pkg:maven/org.springframework/spring-context@3.2.18.RELEASE?type=jar
pkg:maven/org.springframework/spring-context-support@3.2.18.RELEASE?type=jar
pkg:maven/org.springframework/spring-tx@3.2.18.RELEASE?type=jar
pkg:maven/org.springframework/spring-jdbc@3.2.18.RELEASE?type=jar
pkg:maven/org.springframework/spring-orm@3.2.18.RELEASE?type=jar
pkg:maven/org.springframework/spring-oxm@3.2.18.RELEASE?type=jar
pkg:maven/org.springframework/spring-web@3.2.18.RELEASE?type=jar
pkg:maven/org.springframework/spring-webmvc@3.2.18.RELEASE?type=jar

On attachment a fragment of our bom.
[bom_fragment.txt](https://github.com/DependencyTrack/dependency-track/files/6250918/bom_fragment.txt)