High severity · published Jan 5, 2021
CVE-2020-17519
Apache Flink directory traversal attack: reading remote files through the REST API
In wildKEV
7.5
CVSS
97.8%
EPSS
Yes
On KEV
Description
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)97.8% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 23, 2024
Federal remediation dueJun 13, 2024
Ransomware campaign useNot known
Affected products
Which versions
AF
Apache Flink · Apache Software Foundation
Apache Flink 1.11.0 to 1.11.2 · source: vendor
FL
Flink · Apache
1.11.0 before 1.11.3 · source: NVD, CISA, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-17519
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-17519
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E
mailing-list
https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cuser.flink.apache.org%3E
mailing-list
https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cannounce.apache.org%3E
mailing-list
http://www.openwall.com/lists/oss-security/2021/01/05/2
mailing-list
https://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe75756012dda62ac623766bb9bc5e7034%40%3Cissues.flink.apache.org%3E
x_refsource_MISC
http://packetstormsecurity.com/files/160849/Apache-Flink-1.11.0-Arbitrary-File-Read-Directory-Traversal.html
More from Apache Flink
8.1
CVE-2026-35194
Apache Flink: Remote code execution via SQL injection in code generation