CVE-2020-5427: Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query
Published Jan 27, 2021
·Updated
In Spring Cloud Data Flow, versions 2.6.x prior to 2.6.5, versions 2.5.x prior 2.5.4, an application is vulnerable to SQL injection when requesting task execution.
Affected Software
2 affected components
VMware Spring Cloud Data Flow>=2.5.0<2.5.4
VMware Spring Cloud Data Flow>=2.6.0<2.6.5
Event History
Jan 27, 2021
CVE Published
via MITRE·05:30 PM
Data Sourced
via MITRE·05:30 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-5427?
CVE-2020-5427 is rated as a high severity vulnerability due to the potential for SQL injection attacks.
2
How do I fix CVE-2020-5427?
To remediate CVE-2020-5427, upgrade Spring Cloud Data Flow to versions 2.5.4 or 2.6.5 or later.
3
What applications are affected by CVE-2020-5427?
CVE-2020-5427 affects Spring Cloud Data Flow versions 2.6.x prior to 2.6.5 and 2.5.x prior to 2.5.4.
4
Is CVE-2020-5427 an easily exploitable vulnerability?
Yes, CVE-2020-5427 can be easily exploited by attackers to execute arbitrary SQL queries.
5
What are the potential impacts of exploiting CVE-2020-5427?
Exploiting CVE-2020-5427 may lead to unauthorized data access, data manipulation, or denial of service.