CVE-2024-37084: Remote code execution in Spring Cloud Data Flow
In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server
Published Jul 25, 2024 · Updated Aug 2, 2024
Affected packages
org.springframework.cloud:spring-cloud-skipper
- Ecosystem
- Maven
- Affected
- < 2.11.4
- Fixed in
- 2.11.4
- Check
mvn dependency:tree -Dincludes=org.springframework.cloud:spring-cloud-skipper
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology