exploitDog

CVE-2020-17518

Опубликовано: 05 янв. 2021

Источник: redhat

CVSS3: 7.5

EPSS Критический

Описание

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.

Ссылки на источники

Дополнительная информация

Статус:

Moderate

Дефект:

CWE-22

https://bugzilla.redhat.com/show_bug.cgi?id=1913312apache-flink: directory traversal attack allows remote file writing through the REST API

EPSS

Процентиль: 100%

0.9379

Критический

7.5 High

CVSS3

Связанные уязвимости

CVE-2020-17518

CVSS3: 7.5

nvd

около 5 лет назад

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.

GHSA-7q5g-gph2-4rc6

CVSS3: 7.5

github

почти 4 года назад

Upload of file to arbitrary path in Apache Flink

EPSS

Процентиль: 100%

0.9379

Критический

7.5 High

CVSS3