CVE-2020-5428 MEDIUM

CVE-2020-5428: Possibility of SQL Injection in Spring Cloud Task Execution Sorting Query

Vendor Spring By Vmware

Product Spring Cloud Task

Weakness CWE-89 · SQLi

Published January 27, 2021

Last update September 16, 2024

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Local

Attack complexity High

Privileges required High

User interaction Required

Confidentiality High

Integrity Low

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

In applications using Spring Cloud Task 2.2.4.RELEASE and below, may be vulnerable to SQL injection when exercising certain lookup queries in the TaskExplorer.

Key dates

02Disclosure timeline

January 27, 2021 CVE published

September 16, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-5428 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2022-2847 SourceCodester Guest Management System front.php sql injection CVE-2025-55167 WeGIA SQL Injection via id_fichamedica at endpoint `GET/html/funcionario/dependente_remover.php` CVE-2026-12110 Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter CVE-2025-3685 code-projects Patient Record Management System edit_fpatient.php sql injection CVE-2021-24142 301 Redirects - Easy Redirect Manager < 2.51 - Authenticated SQL Injection