Apache · Flink
CVE-2020-17519
Apache Flink directory traversal attack: reading remote files through the REST API
De quoi s'agit-il
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
CISA: Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.
Que faire
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Échéance pour les agences fédérales américaines : 13 juin 2024
- Ajoutée à la liste de la CISA
- 23 mai 2024
- Publiée
- 5 janvier 2021
- Gravité
- Critique 9,1 CVSS 3.1
- Probabilité d'attaques dans les 30 prochains jours (EPSS)
- 98% dans les 0,1% les plus à risque de toutes les failles connues
- Faiblesse
- CWE-552
- Plus de détails
- NVD · CVE.org · CISA
Toutes les références (17)
- https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink…
- https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cuser.flin…
- https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink…
- https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cannounce.…
- http://www.openwall.com/lists/oss-security/2021/01/05/2
- https://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe75756012dda62ac623766bb9bc5e7034%40%3Cissues.fl…
- http://packetstormsecurity.com/files/160849/Apache-Flink-1.11.0-Arbitrary-File-Read-Directory-Traversal.html
- https://lists.apache.org/thread.html/r2fc60b30557e4a537c2a6293023049bd1c49fd92b518309aa85a0398%40%3Cissues.fl…
- https://lists.apache.org/thread.html/r4e1b72bfa789ea5bc20b8afe56119200ed25bdab0eb80d664fa5bfe2%40%3Cdev.flink…
- https://lists.apache.org/thread.html/r0a433be10676f4fe97ca423d08f914e0ead341c901216f292d2bbe83%40%3Cissues.fl…
- https://lists.apache.org/thread.html/r88b55f3ebf1f8f4e1cc61f030252aaef4b77060b56557a243abb92a1%40%3Cissues.fl…
- https://lists.apache.org/thread.html/r88f427865fb6aa6e6378efe07632a1906b430365e15e3b9621aabe1d%40%3Cissues.fl…
- https://lists.apache.org/thread.html/ra8c96bf3ccb4e491f9ce87ba35f134b4449beb2a38d1ce28fd89001f%40%3Cdev.flink…
- https://lists.apache.org/thread.html/r229167538863518738e02f4c1c5a8bb34c1d45dadcc97adf6676b0c1%40%3Cdev.flink…
- https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.…
- https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.…
- https://lists.apache.org/thread.html/r26fcdd4fe288323006253437ebc4dd6fdfadfb5e93465a0e4f68420d%40%3Cuser-zh.f…
Autres failles exploitées chez Apache
| Ajouté | Faille | Produit | Gravité | Risque d'attaque |
|---|---|---|---|---|
| 8 oct. 2026 | Command Injection | Struts | Élevé 8,1 | 97% |
| 4 août 2026 | Missing Encryption of Sensitive Data | Tomcat | Élevé 7,5 | 99% |
| 16 avr. 2026 | Improper Input Validation | ActiveMQ | Élevé 8,8 | 98% |
| 1 mai 2025 | Improper Escaping of Output | HTTP Server | Critique 9,1 | >99,9% |
| 1 avr. 2025 | Path Equivalence | Tomcat | Critique 10,0 | 99,9% |
| 4 févr. 2025 | Forced Browsing | OFBiz | Critique 9,8 | >99,9% |
| 18 sept. 2024 | Improper Access Control | HugeGraph-Server | Critique 9,8 | 99,2% |
| 27 août 2024 | Incorrect Authorization | OFBiz | Élevé 8,1 | 99,4% |
Sources : Known Exploited Vulnerabilities (CISA, domaine public), CVE records (cve.org) et EPSS (FIRST). Le risque d'attaque est l'estimation EPSS qu'une personne tente d'exploiter la faille dans les 30 prochains jours.