← CVE Intelligence

CVE-2024-37084

CVE-2024-37084: Remote code execution in Spring Cloud Data Flow PUBLISHED

Description (CNA)

In Spring Cloud Data Flow versions prior to 2.11.4,  a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server

Affected (CNA)

Vendor / productVersions
Spring / Spring Cloud Data Flowaffected 2.11.x before 2.11.4

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.