CVE-2020-5428: 
Java vulnerability analysis and mitigation

A SQL injection vulnerability was identified in Spring Cloud Task versions 2.2.4.RELEASE and below, specifically affecting certain lookup queries in the TaskExplorer component. The vulnerability was discovered on November 3, 2020, and publicly disclosed on January 25, 2021. This security issue affects applications using Spring Cloud Task's TaskExplorer functionality (Spring Security, VMware Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 6.0 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L. The issue specifically relates to SQL injection vulnerabilities in the TaskExplorer component when executing certain lookup queries. The weakness is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (NVD).

If successfully exploited, this vulnerability could allow an attacker to perform SQL injection attacks through the TaskExplorer component, potentially leading to unauthorized access to or modification of the underlying database. The CVSS scoring indicates high potential impact on confidentiality and low impact on integrity and availability (NVD).

The vulnerability requires high privileges to exploit, with network access and no user interaction needed. The attack complexity is considered low, making it relatively straightforward to exploit once the necessary access is obtained (NVD).

Users are advised to upgrade to Spring Cloud Task version 2.2.5 or higher. The issue has been fixed in Spring Cloud Task versions 2.3.0 and 2.2.5. No alternative workarounds have been provided (Spring Security).

The vulnerability was responsibly reported by Surfijen Bani of CHECK24 Factory GmbH. VMware has classified this as a LOW severity issue in their security advisory (VMware Advisory).