The U.S. CISA added a security flaw impacting Apache Flink, an open-source, unified stream-processing and batch-processing framework, to the Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.
The vulnerability tracked as CVE-2020-17519, is an improper access control that could allow an attacker to read any file on the local filesystem of the JobManager through its REST interface.
A remote unauthenticated attacker could send a specially crafted directory traversal request that could permit unauthorized access to sensitive information.
The vulnerability, which impacts Flink versions 1.11.0, 1.11.1, and 1.11.2, was addressed in January 2021 in versions 1.11.3 or 1.12.0.
Due to its active exploitation status, federal agencies are recommended to apply the latest fixes by June 13, 2024, to safeguard their networks against active threats
