CVE-2024-37084

VMware Spring Cloud Data Flow vulnerability

9.8 CRITICALEPSS 35.2%

Published25 Jul 2024

Description

In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VMware Spring Cloud Data Flow≥ 2.11.0 < 2.11.4

Remediation

Fixed in

VMware Spring Cloud Data Flow≥ 2.11.4

Frequently asked

Is CVE-2024-37084 being actively exploited?

CVE-2024-37084 is not in the CISA KEV catalog. Its EPSS exploit probability is 35.2%.

How severe is CVE-2024-37084?

CVE-2024-37084 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 35.2% probability of exploitation.

Which products are affected by CVE-2024-37084?

Affected products include VMware Spring Cloud Data Flow.

How do I fix CVE-2024-37084?

Upgrade affected software to a fixed version, for example VMware Spring Cloud Data Flow 2.11.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-37084 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.