Vulnetix
Try Vulnetix Request Demo
CVE-2020-1960 PUBLISHED

A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0) where, when running a process with an enabled JMXReporter, with a port configured via metrics.reporter.reporter_name>.port, an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This compromises any connection established to the process via JMX, allowing extraction of credentials and any other transferred data.

EPSS 0.09% · 25.4th percentile

Risk Scores

EPSS Score
0.09%
25.4th percentile

Affected Products

VendorProductVersions
Bitnamiflink1.10.0, 1.10.0, 1.1.0
Bitnamiflink1.2.0, 1.3.0, 1.4.0

Timeline

References

Open in Interactive Console →