What is GHSA-p528-3mvf-gr87?

GHSA-p528-3mvf-gr87 is a security advisory published by GitHub Security Advisories with Critical severity. Remote code execution in Spring Cloud Data Flow

Which CVE IDs does GHSA-p528-3mvf-gr87 cover?

GHSA-p528-3mvf-gr87 covers the following CVE IDs: CVE-2024-37084. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p528-3mvf-gr87?

GHSA-p528-3mvf-gr87 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-p528-3mvf-gr87?

GHSA-p528-3mvf-gr87 affects 1 product, including: maven/org.springframework.cloud:spring-cloud-skipper:\u003c 2.11.4.

GHSA-p528-3mvf-gr87CriticalCVSS 9.8

Remote code execution in Spring Cloud Data Flow

Vendor

GitHub Security Advisories

Published

July 25, 2024

Last Modified

August 2, 2024

🔗 CVE IDs covered (1)

CVE-2024-37084 →

📋 Description

In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server

🎯 Affected products1

maven/org.springframework.cloud:spring-cloud-skipper:< 2.11.4

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-37084
https://spring.io/security/cve-2024-37084
https://github.com/advisories/GHSA-p528-3mvf-gr87