CVSS: 8.8EPSS: 89%CPEs: 1EXPL: 2CVE-2021-22053
https://notcve.org/view.php?id=CVE-2021-22053
19 Nov 2021 — Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution. Las aplicaciones que usan tanto "spring-cloud-netflix-hystrix-dashboard" como "spring-boot-starter-thymeleaf" e... • https://github.com/Vulnmachines/CVE-2021-22053 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22113
https://notcve.org/view.php?id=CVE-2021-22113
23 Feb 2021 — Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing. Unas aplicaciones que usan la funcionalidad de "Sensitive Headers" en Spring Cloud Netflix Zuul vers... • https://tanzu.vmware.com/security/cve-2021-22113 • CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 90%CPEs: 2EXPL: 0CVE-2020-5412 – Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard
https://notcve.org/view.php?id=CVE-2020-5412
07 Aug 2020 — Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly. Spring Cloud Netflix, versiones 2.2.x anteriores a 2.2.4, versiones 2.1.x anteriores a 2.1.6 y versiones anteriores no compatibles, permiten a la... • https://tanzu.vmware.com/security/cve-2020-5412 • CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') CWE-610: Externally Controlled Reference to a Resource in Another Sphere •