Is CVE-2020-17519 being actively exploited?

Yes — CVE-2020-17519 is in CISA's Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch affected products as a priority.

What products does CVE-2020-17519 affect?

Tracked products affected include Flink. Check the version you run to see whether it is affected.

← All products

CVE-2020-17519

Q: What is CVE-2020-17519?

CVE-2020-17519 is a high-severity software vulnerability (CWE-552) with a CVSS score of 7.5. A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to

HIGH severity · CVSS 7.5 · CWE-552 · actively exploited (CISA KEV)

7.5CVSS HIGH exploited

Actively exploited in the wild (CISA Known Exploited Vulnerabilities). Added to KEV 2024-05-23. US federal agencies must patch by 2024-06-13.

Summary

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)98%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products we track (1)

Flink

Recommendation

This vulnerability is being actively exploited in the wild — patch affected products urgently. Open any affected product above for its exact safe version.

CVE-2020-17519

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information