GitHub Advisoryadvisory · Maven

GHSA-qgcg-p3v2-9h4p Externally Controlled Reference to a Resource in Another Sphere and Confused Deputy in Spring Cloud Netflix

MEDIUM Published 2021-04-30 Modified 2021-04-27 Official page ↗
Aliases
CVE-2020-5412
Ecosystem
Maven
Packages
org.springframework.cloud:spring-cloud-netflix
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
Weaknesses
CWE-441, CWE-610
Reviewed
2021-04-27

Affected packages

• Maven org.springframework.cloud:spring-cloud-netflix: >= 2.2.0, < 2.2.4 → fixed in 2.2.4 • Maven org.springframework.cloud:spring-cloud-netflix: >= 2.1.0, < 2.1.6 → fixed in 2.1.6

Description

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.

Related

Alias · CVE (1)

  • CVE-2020-5412 Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to… vulnerability

Weakness · CWE (2)

  • CWE-441 Unintended Proxy or Intermediary weakness
  • CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness

References