CVE-2020-5412 - CVE House
Back to Database
Status published Medium CVE-2020-5412

Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard

Vulnerability Description

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5412

Credits & Attribution

No credits recorded in the NVD database.

References

More from Spring by VMware

View All →
CVE-2020-5428
Possibility of SQL Injection in Spring Cloud Task Execution Sorting Query
Medium 5.1
CVE-2020-5427
Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query
Medium 5.7
CVE-2020-5421
RFD Protection Bypass via jsessionid
High 8.7
CVE-2020-5413
Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"
Critical 9.8
CVE-2020-5411
Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"
High 8.1

Affected Vendor

Spring by VMware

View all reports →

Affected Software

Spring Cloud Netflix
Vulnerable Versions:
2.2, 2.1

Timeline

Official Publish: August 7th, 2020
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-441

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.