CVE-2024-37084: critical vulnerability in Spring Cloud Data Flow
CVE-2024-37084: Remote code execution in Spring Cloud Data Flow
Published · Updated
Follow this CVE+ Monitor Spring Cloud Data Flow+ Monitor org.springframework.cloud:spring-cloud-skipper
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
60Vexday Risk Score
Keep watching. It has a public proof of concept.
ssvc Attendcvss 9.8epss 35%
from disclosure to weapon47 days
Published on NVDJul 25
1st PoC+47d
In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Spring · Spring Cloud Data Flowpublic PoCs found — 2
githubgithub.com/Kayiyan/CVE-2024-37084-Poc★ 3githubgithub.com/vuhz/CVE-2024-37084★ 2⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.