CVE-2024-37084: Remote code execution in Spring Cloud Data Flow

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Références

advisory github.com
advisory nvd.nist.gov
web spring.io