Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-5412

37
FAUCET Score

CVE-2020-5412 is a Server-Side Request Forgery (SSRF) vulnerability affecting Spring Cloud Netflix versions 2.2.x prior to 2.2.4, 2.1.x prior to 2.1.6, and older unsupported versions. This flaw allows an authenticated attacker to leverage the Hystrix Dashboard proxy.stream endpoint to make requests to internal servers, potentially exposing sensitive information. Rated Medium with a CVSS score of 6.5, the vulnerability has low attack complexity and requires low privileges, leading to high confidentiality impact. While not listed in CISA's KEV catalog and lacking public exploit code or significant community discussion, a Nuclei template for detection exists, indicating potential for exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.1.6CPE matchmatch criteria
cpe:2.3:a:vmware:spring_cloud_netflix:*:*:*:*:*:*:*:*
>= 2.2.0, < 2.2.4CPE matchmatch criteria
cpe:2.3:a:vmware:spring_cloud_netflix:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
10.21%
Probability of exploitation in next 30 days
EPSS Percentile
95.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
Nuclei: CVE-2020-5412 · Sep 1, 2020
This CVE's current EPSS score of 0.1021 is in the 99th percentile among its peer group of 21,957 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

mavenpatch availablevia ghsa
Product: org.springframework.cloud:spring-cloud-netflixFixed in: 2.2.4
mavenpatch availablevia ghsa
Product: org.springframework.cloud:spring-cloud-netflixFixed in: 2.1.6

Vendor Advisories (1)

mavenGHSA-qgcg-p3v2-9h4pmedium

Externally Controlled Reference to a Resource in Another Sphere and Confused Deputy in Spring Cloud Netflix

Apr 30, 2021

References

tanzu.vmware.com / security/cve-2020-5412
Vendor Advisory