CVE-2020-5427

Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query

State: Published
Severity: 5.7 Medium
Published: Jan 27, 2021
Updated: Sep 16, 2024
Reserved: Jan 3, 2020

Description

In Spring Cloud Data Flow, versions 2.6.x prior to 2.6.5, versions 2.5.x prior 2.5.4, an application is vulnerable to SQL injection when requesting task execution.

Scores

CVSS	Score	Vector	Source
3.0	5.7 Medium	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L	pivotal

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
Spring Cloud Data FlowSpring by VMware	2.6 to before 2.6.5Affected 2.5 to before 2.5.4Affected

References

https://tanzu.vmware.com/security/cve-2020-5427

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.