CVE-2020-17519

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalog on 2024-05-23. Federal remediation due 2024-06-13.

SSVC decision

• ExploitationactiveCISA reports credible evidence of active exploitation.
• AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
• Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

97.86% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 99.9% of scored records. A rank, not a probability.

NVD base score

7.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD analysis status

Analyzed. NVD last modified this record on 2026-06-17.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2021-01-05 11:40Z5 YR AGO

Last updated

2025-10-21 23:35Z10 MO AGO

Reserved

2020-08-12

Assigning CNA

apache

Record state

PUBLISHED

Severity

Critical (CVSS 9.1)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weaknesses

• CWE-552Files or Directories Accessible to External PartiesBase

Data version

5.1

Document digest

4f17bfe79155afce50864e02c33d8a7e5b780adc6da4f7a6e118c603ca59d009

• lists.apache.orghttps://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3Ex_refsource_MISC
• lists.apache.org[flink-user] 20210105 [CVE-2020-17519] Apache Flink directory traversal attack: reading remote files through the REST APIhttps://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cuser.flink.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[announce] 20210105 [CVE-2020-17519] Apache Flink directory traversal attack: reading remote files through the REST APIhttps://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cannounce.apache.org%3Emailing-listx_refsource_MLIST
• www.openwall.com[oss-security] 20210105 [CVE-2020-17519] Apache Flink directory traversal attack: reading remote files through the REST APIhttp://www.openwall.com/lists/oss-security/2021/01/05/2mailing-listx_refsource_MLIST
• lists.apache.org[flink-issues] 20210106 [GitHub] [flink-web] zentol commented on a change in pull request #408: Add security page for Flinkhttps://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe75756012dda62ac623766bb9bc5e7034%40%3Cissues.flink.apache.org%3Emailing-listx_refsource_MLIST
• packetstormsecurity.comhttp://packetstormsecurity.com/files/160849/Apache-Flink-1.11.0-Arbitrary-File-Read-Directory-Traversal.htmlx_refsource_MISC
• lists.apache.org[flink-issues] 20210110 [jira] [Updated] (FLINK-20916) Typo in test for CVE-2020-17519https://lists.apache.org/thread.html/r2fc60b30557e4a537c2a6293023049bd1c49fd92b518309aa85a0398%40%3Cissues.flink.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[flink-dev] 20210110 [jira] [Created] (FLINK-20916) Typo in test for CVE-2020-17519https://lists.apache.org/thread.html/r4e1b72bfa789ea5bc20b8afe56119200ed25bdab0eb80d664fa5bfe2%40%3Cdev.flink.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[flink-issues] 20210110 [jira] [Created] (FLINK-20916) Typo in test for CVE-2020-17519https://lists.apache.org/thread.html/r0a433be10676f4fe97ca423d08f914e0ead341c901216f292d2bbe83%40%3Cissues.flink.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[flink-issues] 20210111 [jira] [Assigned] (FLINK-20916) Typo in test for CVE-2020-17519https://lists.apache.org/thread.html/r88b55f3ebf1f8f4e1cc61f030252aaef4b77060b56557a243abb92a1%40%3Cissues.flink.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[flink-issues] 20210111 [jira] [Commented] (FLINK-20916) Typo in test for CVE-2020-17519https://lists.apache.org/thread.html/r88f427865fb6aa6e6378efe07632a1906b430365e15e3b9621aabe1d%40%3Cissues.flink.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[flink-dev] 20210113 Re: [DISCUSS] Releasing Apache Flink 1.10.3https://lists.apache.org/thread.html/ra8c96bf3ccb4e491f9ce87ba35f134b4449beb2a38d1ce28fd89001f%40%3Cdev.flink.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[flink-dev] 20210115 Re: [DISCUSS] Releasing Apache Flink 1.10.3https://lists.apache.org/thread.html/r229167538863518738e02f4c1c5a8bb34c1d45dadcc97adf6676b0c1%40%3Cdev.flink.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[announce] 20210125 Apache Software Foundation Security Report: 2020https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[announce] 20210223 Re: Apache Software Foundation Security Report: 2020https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.orghttps://lists.apache.org/thread.html/r26fcdd4fe288323006253437ebc4dd6fdfadfb5e93465a0e4f68420d%40%3Cuser-zh.flink.apache.org%3Ex_refsource_MISC
• www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17519government-resource