CVE-2020-5412: 
Java vulnerability analysis and mitigation

Spring Cloud Netflix versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions were identified with a security vulnerability (CVE-2020-5412) discovered in August 2020. The vulnerability affects the Hystrix Dashboard proxy.stream endpoint functionality, which could allow unauthorized access to internal servers (Spring Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue is classified under CWE-610 (Externally Controlled Reference to a Resource in Another Sphere) and CWE-441 (Unintended Proxy or Intermediary). The vulnerability allows the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard (NVD).

A malicious user or attacker can exploit this vulnerability to send requests to other servers that should not be exposed publicly, potentially accessing sensitive internal systems or services (Spring Advisory).

The vulnerability requires network access and low privilege level to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

Users should upgrade to Spring Cloud Netflix version 2.2.4 or 2.1.6 depending on their current version branch. Additionally, it is recommended that the Hystrix Dashboard in spring-cloud-netflix should only be available on internal networks to clients that require it and should be secured with Spring Security. This limits exposure to the vulnerability to those with internal network access and proper authentication (Spring Advisory).

The vulnerability was identified and responsibly reported by Vern from PingAn Galaxy Lab (Spring Advisory).