Is CVE-2020-17519 actively exploited?

Yes. CVE-2020-17519 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2020-17519 be exploited remotely?

The attack vector of CVE-2020-17519 has not been classified yet.

What is the CVSS score of CVE-2020-17519?

CVE-2020-17519 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2020-17519

HIGHCISA KEVIN THE WILD

CVE-2020-17519

Published: May 23, 2024

EPSS:94.38%probability of exploitation in 30 daysPercentile:100.0th

Official Description

Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.

NVD Source

CISA KEV Advisory

Apache Flink Improper Access Control Vulnerability

Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.

Added to KEV: 2024-05-23Federal patch deadline: 2024-06-13

Required Action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Risk Analysis

Apache Flink has an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager via its REST interface. The very high EPSS score of 0.94383 indicates a strong likelihood of exploitation, posing a significant data exposure risk.

This vulnerability is actively exploited in the wild and is included in CISA's KEV catalog, confirming its active use by threat actors. The vulnerability is remotely exploitable through the JobManager's REST interface.

Recommended Action

Administrators should update Apache Flink to a patched version to resolve the improper access control vulnerability. Restrict network access to the JobManager's REST interface to only trusted sources.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2020-17519 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2020-17519 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.