CVE-2019-3799CWE-22

CVE-2019-3799: vulnerability in Spring Cloud Config

Directory Traversal with spring-cloud-config-server

Published · Updated

Follow this CVE+ Monitor Spring Cloud Config+ Monitor org.springframework.cloud:spring-cloud-config-server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

62Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 85%
from disclosure to weaponsame day
Published on NVDMay 6
1st PoCApr 17
metasploitApr 17
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product
Red Hat Fuse 7
no_fix_planned: Will not fix
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Affected products
Spring · Spring Cloud Config
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Spring Cloud Config

In the same product, most dangerous first.

CVE-2026-40982CRITICALCVE-2026-40982EPSS 0.7%CVE-2026-47837MEDIUMSpring Cloud Config Server Monitor Endpoint Does Not Validate Webhook RequestsEPSS 0.6%CVE-2026-47894MEDIUMSpring Cloud Config Server Native Environment Repository ExposureEPSS 0.5%CVE-2026-40981HIGHCVE-2026-40981EPSS 0.4%CVE-2026-59315MEDIUMSpring Cloud Config Monitor Denial of ServiceEPSS 0.4%CVE-2025-22232MEDIUMSpring Cloud Config Server May Not Use Vault Token Sent By ClientsEPSS 0.3%