CVE-2020-17519

Confirmed PUBLISHED

Apache Flink directory traversal attack: reading remote files through the REST API

Apache Software Foundation · Apache Flink

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

7.5 High EPSS 97.9%

At a Glance

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.

cisa apache nessus_scanner nuclei_scanner

CVE Published: Jan 05, 2021
Exploitation Reported: May 23, 2024
CVSS: 7.5 High
EPSS: 97.9%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
apache	flink	1.11.0 to <= 1.11.2	Affected
Apache Software Foundation	Apache Flink	Apache Flink 1.11.0 to 1.11.2	Affected

CVE References

[flink-user] 20210105 [CVE-2020-17519] Apache Flink directory traversal attack: reading remote files through the REST API lists.apache.org · Mailing List https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f...
[announce] 20210105 [CVE-2020-17519] Apache Flink directory traversal attack: reading remote files through the REST API lists.apache.org · Mailing List https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f...
[oss-security] 20210105 [CVE-2020-17519] Apache Flink directory traversal attack: reading remote files through the REST API openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/01/05/2
[flink-issues] 20210106 [GitHub] [flink-web] zentol commented on a change in pull request #408: Add security page for Flink lists.apache.org · Mailing List https://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe7575601...
[flink-issues] 20210110 [jira] [Updated] (FLINK-20916) Typo in test for CVE-2020-17519 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r2fc60b30557e4a537c2a6293023049b...

Show 11 more references

[flink-dev] 20210110 [jira] [Created] (FLINK-20916) Typo in test for CVE-2020-17519 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r4e1b72bfa789ea5bc20b8afe5611920...
[flink-issues] 20210110 [jira] [Created] (FLINK-20916) Typo in test for CVE-2020-17519 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r0a433be10676f4fe97ca423d08f914e...
[flink-issues] 20210111 [jira] [Assigned] (FLINK-20916) Typo in test for CVE-2020-17519 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r88b55f3ebf1f8f4e1cc61f030252aae...
[flink-issues] 20210111 [jira] [Commented] (FLINK-20916) Typo in test for CVE-2020-17519 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r88f427865fb6aa6e6378efe07632a19...
[flink-dev] 20210113 Re: [DISCUSS] Releasing Apache Flink 1.10.3 lists.apache.org · Mailing List https://lists.apache.org/thread.html/ra8c96bf3ccb4e491f9ce87ba35f134b...
[flink-dev] 20210115 Re: [DISCUSS] Releasing Apache Flink 1.10.3 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r229167538863518738e02f4c1c5a8bb...
[announce] 20210125 Apache Software Foundation Security Report: 2020 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942...
[announce] 20210223 Re: Apache Software Foundation Security Report: 2020 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b5...
Apache Mailing List lists.apache.org · CVE Record https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f...
packetstormsecurity.com/files/160849/Apache-Flink-1.11.0-Arbitrary-F... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/160849/Apache-Flink-1.11.0-Arbit...
Apache Mailing List lists.apache.org · CVE Record https://lists.apache.org/thread.html/r26fcdd4fe288323006253437ebc4dd6...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2024-05-23 00:00 UTC
The Shadowserver	2026-06-15 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17519.yaml	Apr 25, 2025

CVSS Scores

CVSS v3.1 7.5 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0 5.0 Medium

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitation Status

Exploited in the wild

Recorded 2024-05-23 00:00:00 UTC · CISA

Proof of concept available

Recorded 2021-01-06 02:15:39 UTC · GitHub

Weaknesses (CWE)

CWE-552

Files or Directories Accessible to External Parties

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17519.yaml	Apr 25, 2025
Nessus	https://www.tenable.com/plugins/nessus/146314	Mar 08, 2023

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

zhangweijie11/CVE-2020-17519

github · Created 2022-03-08 09:19:27 UTC · 0 stars

givemefivw/CVE-2020-17519

github · Created 2021-04-13 11:38:18 UTC · 1 stars

CVE-2020-17519 Cheetah

murataydemir/CVE-2020-17519

github · Created 2021-01-10 01:24:50 UTC · 8 stars

[CVE-2020-17519] Apache Flink RESTful API Arbitrary File Read

hoanx4/CVE-2020-17519

github · Created 2021-01-08 06:50:59 UTC · 0 stars

CVE-2020-17519

QmF0c3UK/CVE-2020-17519

github · Created 2021-01-06 13:41:24 UTC · 1 stars

B1anda0/CVE-2020-17519

github · Created 2021-01-06 02:15:39 UTC · 48 stars

Apache Flink 目录遍历漏洞批量检测 (CVE-2020-17519)

Apache Flink - Local File Inclusion

nuclei · Created Unknown

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2020-17519

{
  "cve_id": "CVE-2020-17519",
  "title": "Apache Flink directory traversal attack: reading remote files through the RES...",
  "affected_vendor": "Apache Software Foundation",
  "affected_product": "Apache Flink",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.5,
  "epss_score": 0.97856,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2020-17519

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API