{"cve":"CVE-2020-5412","nvd":{"published":"2020-08-07T21:15:10.630","modified":"2026-06-17T03:21:26.807","status":"Modified","description":"Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-610","CWE-441"],"references":["https://tanzu.vmware.com/security/cve-2020-5412","https://tanzu.vmware.com/security/cve-2020-5412"],"products":["vmware:spring_cloud_netflix"],"source":"nvd","synced_at":"2026-10-19T21:06:22.076270124+00:00"},"epss":{"cve":"CVE-2020-5412","score":0.10214,"percentile":0.95673,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-qgcg-p3v2-9h4p","url":"https://osv.dev/vulnerability/GHSA-qgcg-p3v2-9h4p","summary":"Externally Controlled Reference to a Resource in Another Sphere and Confused Deputy in Spring Cloud Netflix","modified":"2023-11-08T04:03:55.528861Z","packages":[{"ecosystem":"Maven","name":"org.springframework.cloud:spring-cloud-netflix","purl":"pkg:maven/org.springframework.cloud/spring-cloud-netflix","ranges":[">=2.2.0 <2.2.4"],"fixed":["2.2.4"]},{"ecosystem":"Maven","name":"org.springframework.cloud:spring-cloud-netflix","purl":"pkg:maven/org.springframework.cloud/spring-cloud-netflix","ranges":[">=2.1.0 <2.1.6"],"fixed":["2.1.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}