VMware Spring Cloud Data Flow vulnerabilities

2 CVEs affecting VMware Spring Cloud Data Flow, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-37084, published 2024-07-25.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-37084, published 2024-07-25. High severity, CVSS 8.8. EPSS: 35.2% chance of exploitation in the next 30 days. In Spring Cloud Data Flow versions prior to 2.11.4,  a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file…
• CVE-2020-5427, published 2021-01-27. High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days. In Spring Cloud Data Flow, versions 2.6.x prior to 2.6.5, versions 2.5.x prior 2.5.4, an application is vulnerable to SQL injection when requesting task execution.