CVE-2024-22263: Arbitrary File Write Vulnerability in Spring Cloud Data Flow
Spring Cloud Data Flow is a microservices-based Streaming and Batch data processing in Cloud Foundry and Kubernetes. The Skipper server has the ability to receive upload package requests. However, due to improper sanitization for upload path, a malicious user who has access to skipper server api can use a crafted upload request to write arbitrary file to any location on file system, may even compromises the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22263?
CVE-2024-22263 has been classified as a medium severity vulnerability due to its potential impact on the confidentiality and integrity of data.
How do I fix CVE-2024-22263?
To resolve CVE-2024-22263, upgrade to the latest version of Spring Cloud Data Flow that includes the security patch addressing the improper sanitization issue.
Who is affected by CVE-2024-22263?
CVE-2024-22263 affects users of Pivotal Spring Cloud Data Flow that utilize the Skipper server for package uploads.
What type of vulnerability is CVE-2024-22263?
CVE-2024-22263 is classified as an improper sanitization vulnerability that allows potential path traversal attacks.
Can CVE-2024-22263 be exploited remotely?
Yes, CVE-2024-22263 can potentially be exploited remotely if an attacker has access to the Skipper server upload functionality.