CVE-2024-22263 | THREATINT

Assigner	vmware
Reserved	2024-01-08
Published	2024-06-19
Updated	2024-08-01

Description

Spring Cloud Data Flow is a microservices-based Streaming and Batch data processing in Cloud Foundry and Kubernetes. The Skipper server has the ability to receive upload package requests. However, due to improper sanitization for upload path, a malicious user who has access to skipper server api can use a crafted upload request to write arbitrary file to any location on file system, may even compromises the server.

HIGH: 8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

Improper sanitization for upload path

Product status

Default status

0x40032b8860

2.11.0 - 2.11.2, 2.10.x

affected

References

https://spring.io/security/cve-2024-22263

cve.org CVE-2024-22263

nvd.nist.gov CVE-2024-22263

Download JSON

https://cve.threatint.com/CVE/CVE-2024-22263

Subscribe to our newsletter to learn more about our work.