NetSight
IP …
high7.5Known exploitedPublic exploit code

CVE-2020-17519

Apache Flink Improper Access Control Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-05-23. Federal due date: 2024-06-13.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.

Affected products

VendorProductAffected versions
ApacheFlink
from 1.11.0 before 1.11.3

Weakness classification

CWE-552

References