Moderate severityNVD Advisory· Published Mar 5, 2020· Updated Sep 16, 2024
Directory Traversal with spring-cloud-config-server
CVE-2020-5405
Description
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework.cloud:spring-cloud-config-serverMaven | >= 2.1.0, < 2.1.7 | 2.1.7 |
org.springframework.cloud:spring-cloud-config-serverMaven | >= 2.2.0, < 2.2.2 | 2.2.2 |
Affected products
1- Range: 2.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/advisories/GHSA-g86w-v5vg-9gxfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-5405ghsaADVISORY
- pivotal.io/security/cve-2020-5405ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.