CVE-2020-5412CWE-441

Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard

published August 7, 2020

CVSS
—
EPSS
10%
Percentile
95.7
In the wild
Unconfirmed
What it is

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.10214 · 95.7th percentile
Weakness
CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')
Published
2020-08-07T20:45Z
EPSS history
Timeline
  • 07 AUG 20:45Z
    Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard
    cvelistv5