Externally controlled reference to a resource in another sphere in Spring Cloud Netflix - CVE-2020-5412
Published: February 12, 2021
Vulnerability identifier: #VU50663
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-5412
CWE-ID: CWE-610
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the application allows to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A remote user can send a request to other servers that should not be exposed publicly.
Affected software
Spring Cloud Netflix
How to mitigate CVE-2020-5412
Install updates from vendor's website.
Spring Cloud Netflix - addressed in versions 2.1.6, 2.2.4