cve-2020-17519

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-17519.json"
      }
    ],
    "title": "apache-flink: directory traversal attack allows reading remote files through the REST API",
    "tracking": {
      "current_release_date": "2026-08-04T18:17:17+00:00",
      "generator": {
        "date": "2026-08-04T18:17:17+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "CVE-2020-17519",
      "initial_release_date": "2020-01-01T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2020-01-01T00:00:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-04T15:29:24+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-08-04T18:17:17+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Fuse 7",
                "product": {
                  "name": "Red Hat Fuse 7",
                  "product_id": "red_hat_fuse_7",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Fuse 7"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Integration Camel K 1",
                "product": {
                  "name": "Red Hat Integration Camel K 1",
                  "product_id": "red_hat_integration_camel_k_1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:integration:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Integration Camel K 1"
          },
          {
            "category": "product_version",
            "name": "camel-flink",
            "product": {
              "name": "camel-flink",
              "product_id": "camel-flink",
              "product_identification_helper": {
                "purl": "pkg:maven/org.apache.camel/camel-flink?repository_url=https://maven.repository.redhat.com/ga/&type=jar"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "camel-flink as a component of Red Hat Fuse 7",
          "product_id": "red_hat_fuse_7:camel-flink"
        },
        "product_reference": "camel-flink",
        "relates_to_product_reference": "red_hat_fuse_7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "camel-flink as a component of Red Hat Integration Camel K 1",
          "product_id": "red_hat_integration_camel_k_1:camel-flink"
        },
        "product_reference": "camel-flink",
        "relates_to_product_reference": "red_hat_integration_camel_k_1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-17519",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "discovery_date": "2021-01-05T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "red_hat_fuse_7:camel-flink",
            "red_hat_integration_camel_k_1:camel-flink"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1913317"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-flink: directory traversal attack allows reading remote files through the REST API",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "red_hat_fuse_7:camel-flink",
          "red_hat_integration_camel_k_1:camel-flink"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-17519"
        },
        {
          "category": "external",
          "summary": "RHBZ#1913317",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1913317"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-17519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-17519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-17519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-17519"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2021-01-05T00:00:00+00:00",
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "red_hat_fuse_7:camel-flink",
            "red_hat_integration_camel_k_1:camel-flink"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2024-05-23T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "red_hat_fuse_7:camel-flink",
            "red_hat_integration_camel_k_1:camel-flink"
          ]
        }
      ],
      "title": "apache-flink: directory traversal attack allows reading remote files through the REST API"
    }
  ]
}