CVE-2020-17519criticalunder attackCWE-552

CVE-2020-17519: critical vulnerability in Apache Flink

Apache Flink directory traversal attack: reading remote files through the REST API

Published · Updated

Follow this CVE+ Monitor Apache Flink+ Monitor org.apache.flink:flink-runtime_2.11

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.1epss 98%
from disclosure to weapon1 day
Published on NVDJan 5
1st PoC+1d
metasploitJan 5
CISA KEV+1234d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
2 products — because the vulnerable code is not present in the product
Red Hat Fuse 7 · Red Hat Integration Camel K 1
Action required by CISAfederal deadline: 2024-06-13

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Apache Flink versions 1.11.0 through 1.11.2 contain a flaw that lets attackers read any file on the server's disk through the JobManager's REST API. This bypasses normal file access restrictions and could expose sensitive data.

Technical detail

A directory traversal vulnerability in Apache Flink 1.11.0–1.11.2 allows unauthenticated or low-privileged attackers to enumerate and read arbitrary files accessible by the JobManager process via the REST API endpoint. The vulnerability has no authentication requirement and permits disclosure of sensitive configuration files, credentials, and application data.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected products
Apache Software Foundation · Apache Flink
public PoCs found — 29✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/49398githubgithub.com/MrCl0wnLab/SimplesApachePathTraversal★ 61githubgithub.com/B1anda0/CVE-2020-17519★ 46githubgithub.com/murataydemir/CVE-2020-17519★ 8githubgithub.com/dolevf/apache-flink-directory-traversal.nse★ 3githubgithub.com/givemefivw/CVE-2020-17519★ 1githubgithub.com/QmF0c3UK/CVE-2020-17519★ 1githubgithub.com/yaunsky/CVE-2020-17519-Apache-Flink★ 1githubgithub.com/dev-team-12x/CVE-2020-17519★ 0githubgithub.com/shoucheng3/apache__flink_CVE-2020-17519_1-11-2★ 0githubgithub.com/zhangweijie11/CVE-2020-17519★ 0githubgithub.com/Osyanina/westone-CVE-2020-17519-scanner★ 0githubgithub.com/CyberCTF/vulhub-flink-cve-2020-17519★ 0githubgithub.com/radbsie/CVE-2020-17519-Exp★ 0githubgithub.com/GazettEl/CVE-2020-17519★ 0vulncheckvulncheck.com/xdb/e355b723e6faunverifiedvulncheckvulncheck.com/xdb/7fe03bf0f0a6unverifiedvulncheckvulncheck.com/xdb/7c9fe2b962fdunverifiedvulncheckvulncheck.com/xdb/1b1d6d820b0cunverifiedvulncheckvulncheck.com/xdb/a0b10abc1d63unverifiedvulncheckvulncheck.com/xdb/c096ce6f775bunverifiedvulncheckvulncheck.com/xdb/259c72303ba8unverifiedvulncheckvulncheck.com/xdb/02f7b73ab684unverifiedvulncheckvulncheck.com/xdb/5060de9f4f15unverifiedvulncheckvulncheck.com/xdb/50a45f679975unverifiedvulncheckvulncheck.com/xdb/9be1f64fbcd2unverifiedvulncheckvulncheck.com/xdb/1620553c643aunverifiedcve_referencepacketstormsecurity.com/files/160849/Apache-Flink-1.11.0-Arbitrary-File-Read-Directory-Traversal.htmlunverifiedvulncheckvulncheck.com/xdb/7159401b812cunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache Flink

In the same product, most dangerous first.

CVE-2020-17518—Apache Flink directory traversal attack: remote file writing through the REST APIEPSS 49.4%CVE-2026-35194HIGHApache Flink: Remote code execution via SQL injection in code generationEPSS 0.4%