Back to feed
EUVD-2021-0861 · Published Apr 30, 2021
Externally Controlled Reference to a Resource in Another Sphere and Confused Deputy in Spring Cloud Netflix Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
Technologies
Vmware Spring Cloud Netflix
Weaknesses
CWE-441CWE-610
CVSS scores
- v3.16.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access Command and Control
References
Potentially impacted assets
See if this affects your attack surface
