CVE-2024-37084: Remote code execution in Spring Cloud Data Flow
60Vexday Risk Score
Keep watching. It has a public proof of concept.
ssvc Attendcvss 9.8epss 35%
from disclosure to weapon47 days
Published on NVDJul 25
1st PoC+47d
exploitation probability
35%top 2% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Spring · Spring Cloud Data Flowpublic PoCs found — 2
githubgithub.com/Kayiyan/CVE-2024-37084-Poc★ 3githubgithub.com/vuhz/CVE-2024-37084★ 2⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.