Apache Flink - Local File Inclusion

Apache Flink 1.11.0 and released in 1.11.1 and 1.11.2 as well allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process aka local file inclusion. id: CVE-2020-17519 info: name: Apache Flink - Local File Inclusion author: pdtea...

Apache Flink JobManager Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Flink JobManager Traversal', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability in Apache Flink...

CISA Warns of Actively Exploited Apache Flink Security Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a security flaw impacting Apache Flink, an open-source, unified stream-processing and batch-processing framework, to the Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. Tracked as...

Metasploit Wrap-Up

Hey who finked about Flink? In this week's round of modules, contributor bcoles offered up two modules to leverage that Apache Flink install you found in some fun new ways. If you are just looking to filch a few files, auxiliary/scanner/http/apacheflinkjobmanagertraversal leverages CVE-2020-17519...

Apache Flink JobManager Traversal

This module exploits an unauthenticated directory traversal vulnerability in Apache Flink versions 1.11.0 use auxiliary/scanner/http/apacheflinkjobmanagertraversal msf auxiliaryapacheflinkjobmanagertraversal show actions ...actions... msf auxiliaryapacheflinkjobmanagertraversal set ACTION msf...

Exploit for Files or Directories Accessible to External Parties in Apache Flink

CVE-2020-17519 Apache Flink Arbitrary File Reading Vulnerabil...

Apache Flink Directory Traversal (CVE-2020-17518; CVE-2020-17519)

A directory traversal vulnerability exists in Apache Flink. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

Exploit for Files or Directories Accessible to External Parties in Apache Flink

CVE-2020-17519 Apache Flink RESTful API Arbitrary File Read -...

Apache Flink 1.11.0 Arbitrary File Read / Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Flink File Read Vulnerability', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability in Apache Fli...

CVE-2020-17519

creationtimestamp| type| source ---|---|--- 2021-01-08 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/49398 2021-02-23 15:29:39+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apacheflinkjobmanagertraversal.rb 2021-03-17...

Apache Flink 1.11.0 - Unauthenticated Arbitrary File Read (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Flink File Read Vulnerability', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability in Apache Fli...

Exploit for Files or Directories Accessible to External Parties in Apache Flink

Usage & Disclaimer This script addresses a directory travers...

CVE-2020-17519

A change introduced in Apache Flink 1.11.0 and released in 1.11.1 and 1.11.2 as well allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users shou...

CVE-2020-17519 Apache Flink directory traversal attack: reading remote files through the REST API

A change introduced in Apache Flink 1.11.0 and released in 1.11.1 and 1.11.2 as well allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users shou...

CVE-2020-17519 Apache Flink directory traversal attack: reading remote files through the REST API

A change introduced in Apache Flink 1.11.0 and released in 1.11.1 and 1.11.2 as well allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users shou...

CVE-2020-17519

CVE-2020-17519 is an Apache Flink directory traversal vulnerability that permits reading arbitrary files on the JobManager host via the REST interface. The flaw stems from a change introduced in Flink 1.11.0 (affecting 1.11.0, 1.11.1, and 1.11.2) and is limited to files accessible by the JobManag...

Design/Logic Flaw

u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central deviceThis CVE is equivalent to Link Layer Length Overfow issue CVE-2019-16336,CVE-2019-17519 and Silent Length Overflow issueCVE-2019-17518 mentioned in...

CVE-2020-3703

The connected Red Hat CVE entries confirm a concrete BLE Link Layer handling flaw: Cypress PSoC 4 BLE component

CVE-2019-17519

The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet...

CVE-2019-17519

The CVE-2019-17519 issue affects NXP Bluetooth Low Energy in the KW41Z SDK (up to v2.2.1). The root cause is failure to properly restrict the Link Layer payload length, enabling attackers in radio range to trigger a buffer overflow with a crafted packet. The SweynTooth report and Red Hat/NVD refe...