CVE-2024-37084

In Spring Cloud Data Flow, versions prior to 2.11.4 (notably 2.11.0–2.11.3) are affected. A malicious user with access to the Skipper server API can send a crafted upload request to write an arbitrary file to any location on the file system, which could lead to remote code execution and full serv...