Apache Flink 路径遍历漏洞

Apache Flink is an efficient and distributed general purpose data processing platform. Apache Flink products have an arbitrary file write vulnerability that can be exploited by an attacker to read sensitive files on the server and with the help of hard-coded credentials exploit the vulnerability ...

PT-2021-10097 · Apache · Apache Flink

Name of the Vulnerable Software and Affected Versions: Apache Flink versions 1.11.0 through 1.11.2 Description: A change introduced in Apache Flink allows attackers to read any file on the local filesystem of the JobManager through the REST interface. Access is restricted to files accessible by t...

PT-2021-10096 · Apache · Apache Flink

Name of the Vulnerable Software and Affected Versions: Apache Flink versions 1.5.1 Description: A REST handler in Apache Flink allows writing an uploaded file to any location on the local file system through a maliciously modified HTTP HEADER. This issue enables files to be written to any locatio...

CVE-2020-17519

A change introduced in Apache Flink 1.11.0 and released in 1.11.1 and 1.11.2 as well allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users shou...

apache-flink: JMX information disclosure vulnerability

A vulnerability in Apache Flink 1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0 where, when running a process with an enabled JMXReporter, with a port configured via...

Apache Flink 1.9.x - File Upload RCE (Unauthenticated)

!/usr/bin/env python3 coding: utf-8 Exploit Title: Apache Flink 1.9.x - File Upload RCE Unauthenticated Google Dork: None Date: 2020.11.01 Exploit Author: bigger.wing Vendor Homepage: https://flink.apache.org/ Software Link: https://flink.apache.org/downloads.html Version: 1.9.x Tested on:...

Apache Flink 1.9.x Shell Upload

!/usr/bin/env python3 coding: utf-8 Exploit Title: Apache Flink 1.9.x - File Upload RCE Unauthenticated Google Dork: None Date: 2020.11.01 Exploit Author: bigger.wing Vendor Homepage: https://flink.apache.org/ Software Link: https://flink.apache.org/downloads.html Version: 1.9.x Tested on:...

CVE-2020-1960

A vulnerability in Apache Flink 1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0 where, when running a process with an enabled JMXReporter, with a port configured via...

apache-flink-user-mailing-list-archive.2336050.n4.nabble.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1181942 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

POC-EXP

This repository contains a collection of proof-of-concept PoC exploits for various vulnerabilities. The exploits are written in Python and target different applications, including Apache James Server, Apache Flink Web Dashboard, and Apache Solr. The Apache James Server exploit is a remote command...

Apache Flink Injection Vulnerability

Apache Flink is an open source distributed streaming data processing engine from the US Apache Software Apache Software Foundation. The product is mainly written in Java and Scala languages. There is a security vulnerability in Apache Flink. A local attacker can exploit the vulnerability with the...

CVE-2020-1960

A vulnerability in Apache Flink 1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0 where, when running a process with an enabled JMXReporter, with a port configured via...

CVE-2020-1960

A vulnerability in Apache Flink 1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0 where, when running a process with an enabled JMXReporter, with a port configured via...

Design/Logic Flaw

A vulnerability in Apache Flink 1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0 where, when running a process with an enabled JMXReporter, with a port configured via...

CVE-2020-1960

A vulnerability in Apache Flink 1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0 where, when running a process with an enabled JMXReporter, with a port configured via...

CVE-2020-1960

CVE-2020-1960 (Apache Flink) affects multiple Flink versions (1.1.0–1.10.0). When a process runs with an enabled JMXReporter and a port configured via metrics.reporter.reporter_name>.port, a local attacker with access to the JMX port can perform a man-in-the-middle attack to rebind the JMXRMI ...

Information Disclosure

flink-metrics is vulnerable to information disclosure. The vulnerability exists as a rebinding attack was possible on the JMXRMI registry...

PT-2020-15193 · Apache · Apache Flink

Name of the Vulnerable Software and Affected Versions: Apache Flink versions 1.1.0 through 1.1.5 Apache Flink versions 1.2.0 through 1.2.1 Apache Flink versions 1.3.0 through 1.3.3 Apache Flink versions 1.4.0 through 1.4.2 Apache Flink versions 1.5.0 through 1.5.6 Apache Flink versions 1.6.0...

Apache Flink Remote Code Execution Vulnerability

Apache Flink is an open source stream processing framework developed by the Apache Software Foundation. Apache Flink has a remote code execution vulnerability that can be exploited by uploading a malicious Jar package via the RESTful API to execute arbitrary code...

Apache Flink Arbitrary Jar Package Upload Leads to Remote Code Execution Vulnerability

Apache Flink is developed by the Apache Software Foundation open source stream processing framework , the core is written in Java and Scala distributed streaming data flow engine . Flink to data parallelism and pipelined execution of arbitrary streaming data program , Flink's pipeline runtime...