PT-2021-12401 · Spring · Spring Cloud Data Flow

Sufijen Bani · Published 2021-01-27 · Updated 2024-03-06 · CVE-2020-5427

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Cloud Data Flow versions 2.5.x prior to 2.5.4 Spring Cloud Data Flow versions 2.6.x prior to 2.6.5

Description The application is vulnerable to SQL injection when requesting task execution.

Recommendations For versions 2.5.x prior to 2.5.4, update to version 2.5.4 or later. For versions 2.6.x prior to 2.6.5, update to version 2.6.5 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-SPRING-CLOUD-DATAFLOW-2020-5427

CVE-2020-5427

Affected Products

Spring Cloud Data Flow

References · 6

• https://osv.dev/vulnerability/BIT-spring-cloud-dataflow-2020-5427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5427 · Security Note
• https://tanzu.vmware.com/security/cve-2020-5427 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5427 · Vendor Advisory
• https://t.me/cibsecurity/22734 · Telegram Post
• https://t.me/cvenotify/9422 · Telegram Post