9.8
Critical
CVE-2024-37084 In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a…
Description
In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Cloud Data Flow 2.11 | 2.11.x → < 2.11.4 | 2.11.4 |
| spring_cloud_data_flow 2.11 | 2.11.0 → < 2.11.4 | 2.11.4 |