CVE-2020-5410
Directory Traversal with spring-cloud-config-server
Reported by pivotal · Published June 2, 2020
spring-cloud-config-server is fixed in 2.2.3 and 2.1.9 (Maven Central)
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| org.springframework.cloud:spring-cloud-config-server | Maven Central | 2.2.3, 2.1.9 |
| spring_cloud_config | vmware | 2.2.3, 2.1.9 |
| Spring Cloud Config | Spring by VMware | 2.2.3, 2.1.9 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Spring by VMware | Spring Cloud Config | 2.1, 2.2 |
| Maven | org.springframework.cloud:spring-cloud-config-server | 2.1.0, 2.2.0 |
| Spring by VMware | Spring Cloud Config | 2.1, 2.2 |
Timeline
- Jun 2, 2020 CVE Published
- Jun 15, 2020 PoC Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Sep 8, 2021 VulnCheck XDB Entry (3 in total, the first dated here)
- Jan 12, 2022 VulnCheck KEV Exploitation (8 in total, the first dated here)
- Mar 25, 2022 CISA KEV Added
- Jun 1, 2026 Security Advisory
- Aug 30, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2020-5410
vulnetix vdb fixes CVE-2020-5410Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2020-5410/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart