CVE-2020-5412

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-5412
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5412.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-5412
Aliases
Published
2020-08-07T21:15:10.630Z
Modified
2026-03-10T23:21:29.135956Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.

References

Affected packages

Git / github.com/spring-cloud/spring-cloud-netflix

Affected ranges

Type
GIT
Repo
https://github.com/spring-cloud/spring-cloud-netflix
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2084baf7765f3a97e99d58159e931f84776eed40
Introduced
4164297a89bada128f3363541abbf4151ecb558b
Fixed
a579eb4594713f2f92c90600d74ab7d3930b22b7
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.6"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.2.4"
        }
    ]
}

Affected versions

v2.*
v2.1.4.RELEASE
v2.2.0.RELEASE
v2.2.1.RELEASE
v2.2.2.RELEASE
v2.2.3.RELEASE

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5412.json"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "target": {
            "file": "spring-cloud-netflix-turbine-stream/src/test/java/org/springframework/cloud/netflix/turbine/stream/HystrixStreamAggregatorTests.java"
        },
        "source": "https://github.com/spring-cloud/spring-cloud-netflix/commit/2084baf7765f3a97e99d58159e931f84776eed40",
        "signature_version": "v1",
        "id": "CVE-2020-5412-19b63cd9",
        "digest": {
            "line_hashes": [
                "285158692603548749749350948455606305256",
                "5217905107917217778310849651485135156",
                "108580493678423840839642847049751311253",
                "287103919618170015618128359965538168676",
                "301656440108794712526873584674138137885",
                "158311203790284508554830874090751831047",
                "86122229851326873838221440009743627444",
                "300392759837750683799461162892045924898",
                "47791846896821864938606423723708513786",
                "279430314973762484711226481950392689768",
                "21880315820320810906626192467202635602",
                "191371126203530982587792098903668505407",
                "104041375245467534250955829819971445792",
                "158898712404019832611710980888865507369"
            ],
            "threshold": 0.9
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "spring-cloud-netflix-zuul/src/main/java/org/springframework/cloud/netflix/zuul/filters/route/RibbonRoutingFilter.java"
        },
        "source": "https://github.com/spring-cloud/spring-cloud-netflix/commit/2084baf7765f3a97e99d58159e931f84776eed40",
        "signature_version": "v1",
        "id": "CVE-2020-5412-715b5128",
        "digest": {
            "line_hashes": [
                "184163847847077799466818100616538487072",
                "195651531274151872515336816120100637625",
                "160459286270551778996863243857905282742",
                "187752742624531794654732050628154286613"
            ],
            "threshold": 0.9
        },
        "deprecated": false
    }
]