CVE-2024-37084

🗓️ 25 Jul 2024 09:17:50Reported by vmwareType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 127 Views🌐 WEB

Insecure file upload vulnerability in Spring Cloud Data Flo

Reporter	Title	Published	Views	Family All 17
GithubExploit	Exploit for Code Injection in Vmware Spring_Cloud_Data_Flow	15 Oct 202418:54	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Cloud_Data_Flow	10 Sep 202416:58	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Cloud_Data_Flow	15 Oct 202406:55	–	githubexploit
GithubExploit	Exploit for Code Injection in Vmware Spring_Cloud_Data_Flow	22 Nov 202413:53	–	githubexploit
BDU FSTEC	The vulnerability of the application programming interface of the Skipper server on the Spring Cloud Data Flow microservices platform allows a perpetrator to write a file to any directory in the system using a specially crafted API request.	23 Oct 202400:00	–	bdu_fstec
Circl	CVE-2024-37084	25 Jul 202412:43	–	circl
CNNVD	VMware Spring Cloud Data Flow 安全漏洞	25 Jul 202400:00	–	cnnvd
Cvelist	CVE-2024-37084 CVE-2024-37084: Remote code execution in Spring Cloud Data Flow	25 Jul 202409:17	–	cvelist
Github Security Blog	Remote code execution in Spring Cloud Data Flow	25 Jul 202412:32	–	github
NVD	CVE-2024-37084	25 Jul 202410:15	–	nvd

NVD

Node

vmware spring_cloud_data_flowRange2.11.0–2.11.4

[
  {
    "defaultStatus": "unaffected",
    "product": "Spring Cloud Data Flow",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "2.11.4",
        "status": "affected",
        "version": "2.11.x",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2024-37084

Parameter	Position	Path	Description	CWE
upload	path	api/package/upload	Unvalidated file upload in Spring Cloud Data Flow Skipper server enabling arbitrary file write and potential RCE via crafted YAML payloads.	CWE-94

17 Jun 2026 07:37Current

9.5High risk

Vulners AI Score9.5

CVSS 3.18.8 - 9.8

EPSS0.35211

SSVC

CWE-94