Description
In applications using Spring Cloud Task 2.2.4.RELEASE and below, may be vulnerable to SQL injection when exercising certain lookup queries in the TaskExplorer.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_confirm
https://tanzu.vmware.com/security/cve-2020-5428
Scores
CVSS v3
6.0
EPSS
0.0028
EPSS Percentile
51.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Details
CWE
CWE-89
Status
published
Products (2)
org.springframework.cloud/spring-cloud-task-dependencies
0 - 2.2.5Maven
vmware/spring_cloud_task
< 2.2.4
Published
Jan 27, 2021
Tracked Since
Feb 18, 2026