Apache Flink - Arbitrary File Read (CVE-2020-17519)
294Exploiting IPs reported
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
CrowdSec analysis
CVE-2020-17519 is a vulnerability in Apache Flink that permits attackers to perform directory traversal via the JobManager REST interface, enabling unauthorized access to files on the local filesystem.
CrowdSec has been tracking this vulnerability and its exploits since 10th of March 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2020-17519 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2020-17519 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2020-17519 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.
Observed attacks commonly attempt to access URLs containing /jobmanager/logs/...
Exploitation
Get real-time information about exploitation attempts and actors involved.
Common Weakness Enumeration (CWE)
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.