{"uuid": "9f5c5443-b057-4da6-8405-3628fac0caa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-17519", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_flink_jobmanager_traversal.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"0rich1 - Ant Security FG Lab\", \"Hoa Nguyen - Suncsr Team\", \"bcoles \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated directory traversal vulnerability\\n          in Apache Flink versions 1.11.0 <= 1.11.2. The JobManager REST API fails\\n          to validate user-supplied log file paths, allowing retrieval of arbitrary\\n          files with the privileges of the web server user.\\n\\n          This module has been tested successfully on Apache Flink version 1.11.2\\n          on Ubuntu 18.04.4.\", \"disclosure_date\": \"2021-01-05\", \"fullname\": \"auxiliary/scanner/http/apache_flink_jobmanager_traversal\", \"is_install_path\": true, \"mod_time\": \"2022-02-23 16:27:12 +0000\", \"name\": \"Apache Flink JobManager Traversal\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/apache_flink_jobmanager_traversal.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/apache_flink_jobmanager_traversal\", \"references\": [\"CVE-2020-17519\", \"CWE-22\", \"EDB-49398\", \"PACKETSTORM-160849\", \"URL-https://www.openwall.com/lists/oss-security/2021/01/05/2\", \"URL-https://www.tenable.com/cve/CVE-2020-17519\"], \"rport\": 8081, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:27.006454Z"}