CVE-2020-5410highunder attackCWE-23

CVE-2020-5410: high-severity vulnerability in Spring Cloud Config

Directory Traversal with spring-cloud-config-server

Published · Updated

Follow this CVE+ Monitor Spring Cloud Config+ Monitor Spring Cloud Configuration Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 96%
from disclosure to weapon1 day
Published on NVDJun 2
1st PoC+1d
metasploitJun 1
CISA KEV+661d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
2 products
Red Hat Fuse 7.8.0 · Red Hat Fuse 7.9
fix ↗
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

Spring Cloud Config Server can be tricked into serving files outside its intended configuration directory through a specially crafted URL, allowing attackers to access sensitive files on the system.

Technical detail

Directory traversal vulnerability in spring-cloud-config-server allows unauthenticated attackers to bypass path restrictions via malformed URLs, potentially exposing arbitrary files accessible to the application process. Affects versions 2.2.x before 2.2.3 and 2.1.x before 2.1.9.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Spring by VMware · Spring Cloud Config
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Spring Cloud Config

In the same product, most dangerous first.

CVE-2020-5405—Directory Traversal with spring-cloud-config-serverEPSS 68.5%