Detections
Analytics

SCA: security update for org.apache.flink:flink-core (GHSA-6g88-99wj-8mgg)

medium Tenable Self-Hosted Container Security Plugin ID 411427

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to
 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0) where, when running a
 process with an enabled JMXReporter, with a port configured via metrics.reporter.reporter_name>.port, an
 attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a
 specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This
 compromises any connection established to the process via JMX, allowing extraction of credentials and any
 other transferred data. (CVE-2020-1960)

See Also

https://github.com/advisories/GHSA-6g88-99wj-8mgg

Plugin Details

Severity: Medium

ID: 411427

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Low

Base Score: 1.9

Temporal Score: 1.4

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2020-1960

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/21/2021

Vulnerability Publication Date: 5/14/2020

Reference Information

CVE: CVE-2020-1960

cwe: CWE-74